Cursor launched Jade Sleet's macOS backdoors seconds after a DevOps engineer opened a workspace
SentinelOne has documented North Korea's Jade Sleet inside a small Indian IT services provider, using Rust backdoors built for Apple Silicon and a Terraform lock file that points developers at a fake HashiCorp registry.
The Watch · Security desk
What happened
- SentinelOne, hunting for two macOS backdoors, found a second victim: an India-based IT services provider compromised through the Apple Silicon MacBook of one of its DevOps engineers.
- The FLATROOF and ROOFDECK implants were detected on that laptop as early as March 18, 2026 and sat dormant for 11 days before beaconing and host activity began on March 29.
- The same two backdoors, FLATROOF and ROOFDECK, were used in the March-April 2026 attack on KelpDAO's LayerZero bridge, which is what tied the services firm to Jade Sleet.
Why it matters
- Who's exposed exposure A copy of login.keychain-db and four browsers' stored data taken from one supplier's engineer puts that supplier's customers within reach, and their own networks stay untouched.
- What's now possible capability Decentralized command and control plus signed, key-verified commands takes away the domain incident responders would seize and the option of tasking a captured implant.
- What doesn't add up contradiction GitHub described vendor targeting by this group in July 2023, so a third-party review programme scoped to large suppliers has been mis-scoped for three years.
- Who has to decide decision Any take-home coding exercise that resolves dependencies becomes a question of where it runs, because a lock file pointing at a lookalike registry survives a clean code review.
Next story · Build · yesterday
GhostAction's secret-stealing workflows reached 30,000 repos through hijacked developer accounts, researchers sayConfirmed2 publishers
A .terraform.lock.hcl file records which provider modules a project pulls and from which registry. Jade Sleet (also tracked as PUKCHONG, Slow Pisces, TraderTraitor and UNC4899) shipped candidate repositories containing one that pointed at registry.hashicorp-aws[.]com, so a developer who ran `terraform init` downloaded attacker-controlled modules [4][10]. That takes no exploit, and the source files look clean on review. SentinelOne researchers Albert Priego, Alex Delamotte and Matej Havranek said the repositories were built to match the employer being impersonated: "The GitHub repository themes for coding project lures are designed as infrastructure engineering projects related to the company that the DPRK actors are posing as" [8]. The people receiving the lures worked in DevOps, cryptocurrency or financial technology [7].
On the Indian provider's machine, SentinelOne said the delivery mechanism is unknown [14]. It could date the start: the researchers said Cursor first launched the implants on March 29, seconds after the cloudshield workspace at ~/DevOps-Automation/cloudshield was opened [16].
FLATROOF's Python collection module copies login.keychain-db, browser data from Chrome, Brave, Firefox and Safari, Terminal command histories, installed application listings and a snapshot of running processes, and the backdoor runs its command and control over Telegram [12]. Those are the credentials a DevOps engineer at a services firm holds for other people's infrastructure.
ROOFDECK arrives afterwards, once a foothold exists [21]. It uses the Nostr protocol for decentralized command and control, persists through Launch Agents, and supports remote shell access and lateral movement [13]. "ROOFDECK commands are signed with the operator's private key and their integrity is verified using an embedded public key before execution," SentinelOne said [19]. A decentralized channel survives a blocklist entry or a seized domain, and the signing keeps a defender who holds the binary from tasking it. The implant also re-implements common file and directory commands in its own code, which SentinelOne notes appears in Lazarus' LightlessCan [20].
LayerZero acknowledged the KelpDAO hack publicly on April 19, 2026 [23]. The build that landed the next day deleted the earlier ROOFDECK and FLATROOF binaries and stripped symbols and debug information [18].
The vendor-tier targeting itself is three years old in public reporting. GitHub wrote in July 2023 that "Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms" [6]. The roughly $1.5 billion taken from Bybit's cold wallet infrastructure in early 2025 followed a supply chain compromise of Safe{Wallet}'s developer environment, also a supplier [5]. The macOS side is newer: both families are Rust binaries built for ARM-based macOS [11]. SentinelOne named four lure repositories: gtn-candidate-repo, used in the KelpDAO incident, Northwind-IAC, novacart-interview and terraform-candidate-repo [9].
What to watch
- Whether SentinelOne establishes how FLATROOF and ROOFDECK reached the Indian engineer's MacBook in the first place.
- Whether customers of the breached provider report intrusions traceable to keychain or browser material taken by FLATROOF.
- More typosquatted provider registries showing up in the lock files of interview candidate repositories.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
North Korea's Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the IT services industry, per SentinelOne.
- [2]
SentinelOne's hunt for the two backdoors uncovered an additional unrelated victim, an IT services provider based in India that was compromised through an Apple Silicon MacBook belonging to a DevOps engineer.
- [3]
FLATROOF (aka Gaslight) and ROOFDECK are Apple macOS backdoors previously observed in the March-April 2026 attack on KelpDAO's LayerZero bridge.
- [4]
Jade Sleet is also tracked as PUKCHONG, Slow Pisces, TraderTraitor and UNC4899.
- [5]
In early 2025 the group was tied to the theft of about $1.5 billion from Bybit's cold wallet infrastructure following a supply chain compromise of Safe{Wallet}'s developer environment.
- [6]
GitHub noted in July 2023: "Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms."
- [7]
The campaign uses job interview lures against job seekers, and targeted individuals have been found to work in the DevOps, cryptocurrency or financial technology space.
- [8]
"The GitHub repository themes for coding project lures are designed as infrastructure engineering projects related to the company that the DPRK actors are posing as," security researchers Albert Priego, Alex Delamotte and Matej Havranek said.
- [9]
Observed lure repositories include gtn-candidate-repo (used in the KelpDAO incident), Northwind-IAC, novacart-interview and terraform-candidate-repo.
- [10]
The repositories include a weaponized Terraform dependency lock file (.terraform.lock.hcl) pointing to malicious domains such as registry.hashicorp-aws[.]com, causing the platform to download attacker-controlled modules when the developer runs terraform init.
- [11]
The attack chain culminates in two Rust-based malware families targeting ARM-based macOS systems.
- [12]
FLATROOF uses Telegram for command and control and can execute commands, upload and download files, and steal data via a Python module that collects Chrome, Brave, Firefox and Safari browser data, Terminal command histories, installed application listings, system hardware and software profile, a snapshot of running processes, and a copy of login.keychain-db.
- [13]
ROOFDECK uses the Nostr protocol for decentralized command and control and supports system reconnaissance, file manipulation, remote shell access, lateral movement, and persistence via Launch Agents.
- [14]
The backdoors were detected on that machine as early as March 18, 2026, although the exact delivery mechanism is unknown at this stage.
- [15]
"They remained dormant until March 29, when beaconing and host activity began," the researchers said.
- [16]
"The implants were first launched by Cursor on March 29, seconds after the cloudshield workspace [~/DevOps-Automation/cloudshield] was opened," the researchers said.
- [17]
An updated version of ROOFDECK was deployed on the DevOps engineer's system on April 20, 2026, a day after LayerZero publicly acknowledged the KelpDAO hack.
- [18]
The new ROOFDECK variant removes the existing ROOFDECK and FLATROOF binaries and strips symbols and debug information to evade detection.
- [19]
"ROOFDECK commands are signed with the operator's private key and their integrity is verified using an embedded public key before execution. The command functionalities are separated into distinct handlers in the source code," SentinelOne said.
- [20]
SentinelOne said the implant re-implements many common shell commands related to directory and file operations, a tactic seen in North Korea-aligned toolsets including Lazarus' LightlessCan.
- [21]
Evidence indicates ROOFDECK is deployed as a follow-up tool on compromised hosts after initial foothold and control are established.
- [22]
The implants sat on the engineer's MacBook for 11 days before beaconing began, from detection on March 18, 2026 to activity on March 29.
- [23]
LayerZero's public acknowledgement of the KelpDAO hack fell on April 19, 2026.
Sources
2 independent publishers whose own reporting we read for this story.
- scworld.comNorth Korean hackers target IT firm with macOS backdoors
1 article · September 22, 2026
- thehackernews.comJade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
2 articles · September 21, 2026