Security1 publisher2 min readPublished Updated
Cursor launched Jade Sleet's macOS backdoors seconds after a DevOps engineer opened a workspace
SentinelOne has documented North Korea's Jade Sleet inside a small Indian IT services provider, using Rust backdoors built for Apple Silicon and a Terraform lock file that points developers at a fake HashiCorp registry.
The Watch · Security desk
What happened
- SentinelOne, hunting for two macOS backdoors, found a second victim: an India-based IT services provider compromised through the Apple Silicon MacBook of one of its DevOps engineers.
- The FLATROOF and ROOFDECK implants were detected on that laptop as early as March 18, 2026 and sat dormant for 11 days before beaconing and host activity began on March 29.
- The same two backdoors, FLATROOF and ROOFDECK, were used in the March-April 2026 attack on KelpDAO's LayerZero bridge, which is what tied the services firm to Jade Sleet.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure A copy of login.keychain-db and four browsers' stored data taken from one supplier's engineer puts that supplier's customers within reach, and their own networks stay untouched.
- capability Decentralized command and control plus signed, key-verified commands takes away the domain incident responders would seize and the option of tasking a captured implant.
- contradiction GitHub described vendor targeting by this group in July 2023, so a third-party review programme scoped to large suppliers has been mis-scoped for three years.
- decision Any take-home coding exercise that resolves dependencies becomes a question of where it runs, because a lock file pointing at a lookalike registry survives a clean code review.
A .terraform.lock.hcl file records which provider modules a project pulls and from which registry. Jade Sleet (also tracked as PUKCHONG, Slow Pisces, TraderTraitor and UNC4899) shipped candidate repositories containing one that pointed at registry.hashicorp-aws[.]com, so a developer who ran `terraform init` downloaded attacker-controlled modules [3][9]. That takes no exploit, and the source files look clean on review. SentinelOne researchers Albert Priego, Alex Delamotte and Matej Havranek said the repositories were built to match the employer being impersonated: "The GitHub repository themes for coding project lures are designed as infrastructure engineering projects related to the company that the DPRK actors are posing as" [7]. The people receiving the lures worked in DevOps, cryptocurrency or financial technology [6].
On the Indian provider's machine, SentinelOne said the delivery mechanism is unknown [16]. It could date the start: the researchers said Cursor first launched the implants on March 29, seconds after the cloudshield workspace at ~/DevOps-Automation/cloudshield was opened [18].
FLATROOF's Python collection module copies login.keychain-db, browser data from Chrome, Brave, Firefox and Safari, Terminal command histories, installed application listings and a snapshot of running processes, and the backdoor runs its command and control over Telegram [11]. Those are the credentials a DevOps engineer at a services firm holds for other people's infrastructure.
ROOFDECK arrives afterwards, once a foothold exists [19]. It uses the Nostr protocol for decentralized command and control, persists through Launch Agents, and supports remote shell access and lateral movement [12]. "ROOFDECK commands are signed with the operator's private key and their integrity is verified using an embedded public key before execution," SentinelOne said [13]. A decentralized channel survives a blocklist entry or a seized domain, and the signing keeps a defender who holds the binary from tasking it. The implant also re-implements common file and directory commands in its own code, which SentinelOne notes appears in Lazarus' LightlessCan [14].
LayerZero acknowledged the KelpDAO hack publicly on April 19, 2026 [2]. The build that landed the next day deleted the earlier ROOFDECK and FLATROOF binaries and stripped symbols and debug information [21].
The vendor-tier targeting itself is three years old in public reporting. GitHub wrote in July 2023 that "Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms" [5]. The roughly $1.5 billion taken from Bybit's cold wallet infrastructure in early 2025 followed a supply chain compromise of Safe{Wallet}'s developer environment, also a supplier [4]. The macOS side is newer: both families are Rust binaries built for ARM-based macOS [10]. SentinelOne named four lure repositories: gtn-candidate-repo, used in the KelpDAO incident, Northwind-IAC, novacart-interview and terraform-candidate-repo [8].
What to watch
- Whether SentinelOne establishes how FLATROOF and ROOFDECK reached the Indian engineer's MacBook in the first place.
- Whether customers of the breached provider report intrusions traceable to keychain or browser material taken by FLATROOF.
- More typosquatted provider registries showing up in the lock files of interview candidate repositories.