Jade Sleet Breaches Indian IT Provider With FLATROOF and ROOFDECK Backdoors — Developer-Focused Detection and Hardening Guide

SentinelOne has attributed a fresh intrusion at an India-based IT services provider to Jade Sleet, the North Korean state-aligned threat actor also tracked under overlapping DPRK developer-targeting clusters. The victim is described as a "much smaller organization" in the IT services industry — and that detail matters more than it first appears. This is not a smash-and-grab against a Fortune 500 perimeter. It is a deliberate, methodical campaign against the soft underbelly of the technology supply chain: small and mid-sized service providers whose developers hold credentials, source code access, and trust relationships that cascade into far larger downstream customers.

The intrusion involved two previously undocumented implants — FLATROOF and ROOFDECK — deployed as unauthorized access mechanisms, with tooling aimed at Apple/macOS environments used by developers. No CVE is associated with this activity; the entry vector is Jade Sleet's well-worn tradecraft of social engineering developers directly, typically through fraudulent job recruitment, fake collaboration requests, or trojanized coding assessments and packages. The defensive lesson for 2026 is blunt: your developers are the perimeter, and DPRK operators have industrialized the process of compromising them.

If you are an IT services firm, a SaaS vendor, or any organization whose engineers write code that ships to customers, this campaign is aimed at your threat model.

Technical Analysis

Threat Actor Profile: Jade Sleet

Jade Sleet is a North Korea-attributed intrusion set focused primarily on financial theft and espionage to generate revenue for the DPRK regime. Its hallmarks include:

• Developer-centric social engineering: fake recruiter personas on LinkedIn, fraudulent technical interviews, and "coding test" repositories containing malicious dependencies or booby-trapped build scripts.
• Multi-platform tooling: implants and loaders for macOS, Windows, and Linux, reflecting the mixed reality of modern engineering workstations.
• Supply-chain orientation: compromising smaller service providers and software vendors as a pivot into higher-value downstream targets.

The FLATROOF and ROOFDECK Implants

Based on SentinelOne's disclosure, FLATROOF and ROOFDECK function as complementary unauthorized access mechanisms deployed post-compromise:

• Initial access is achieved through developer-targeted social engineering — a trojanized project, malicious npm/PyPI package, or a "challenge" repository whose build or install scripts execute attacker code the moment the victim runs npm install, pip install, or a build command.
• Staging payloads are typically retrieved via legitimate-looking tooling (curl, wget, node, python) fetching second stages from attacker-controlled infrastructure, often fronted by compromised sites or cloud services to blend with normal developer traffic.
• Persistence on macOS follows the standard DPRK playbook: LaunchAgents in ~/Library/LaunchAgents/ or LaunchDaemons in /Library/LaunchDaemons/, occasionally paired with shell profile injection (~/.zshrc, ~/.bash_profile) or tampering with IDE and Node.js global hooks.
• Post-compromise objectives include harvesting credentials from developer machines — SSH keys (~/.ssh/), cloud CLI tokens (~/.aws/, ~/.azure/, ~/.config/gcloud/), browser-stored secrets, Keychain material, and source code — everything needed to move from one engineer's laptop into CI/CD systems and customer environments.

Affected Environments

• Primary: macOS developer workstations (Apple Silicon and Intel) at software and IT services organizations.
• Secondary: any system reachable from a compromised developer endpoint — build servers, artifact registries, cloud tenants, and customer VPNs.

Exploitation Status

This is confirmed active exploitation in the wild, attributed to a nation-state actor. There is no CVE and no patch — the vulnerability is the trust developers place in recruitment outreach, third-party code, and unvetted dependencies. It is not listed in CISA KEV (no software flaw is involved), but the techniques map cleanly to MITRE ATT&CK: T1204 (User Execution), T1059 (Command and Scripting Interpreter), T1543.001/.004 (Launch Agent/Daemon), T1105 (Ingress Tool Transfer), T1552 (Unsecured Credentials), and T1195 (Supply Chain Compromise).

Detection & Response

This is a technical nation-state intrusion, so full detection engineering follows. The rules below target the behaviors of this campaign — persistence creation, credential access, and tooling abuse — rather than brittle hashes that DPRK operators rotate between victims.

Sigma Rules

---
title: LaunchAgent or LaunchDaemon Persistence Created on macOS
id: 9c1a2b34-5d6e-4f78-9a0b-1c2d3e4f5a6b
status: experimental
description: Detects creation or modification of LaunchAgent/LaunchDaemon property lists on macOS endpoints, a persistence mechanism used by Jade Sleet implants FLATROOF and ROOFDECK to survive reboot on developer workstations.
references:
  - https://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.html
  - https://attack.mitre.org/techniques/T1543/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1543.001
  - attack.t1543.004
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - '/Library/LaunchDaemons/'
      - '/Users/*/Library/LaunchAgents/'
    TargetFilename|endswith: '.plist'
  filter_known_devtools:
    SourceImage|contains:
      - '/Library/Developer/'
      - 'com.apple.dt.Xcode'
  condition: selection and not filter_known_devtools
falsepositives:
  - Legitimate software installers writing LaunchAgents
  - MDM enrollment and enterprise tooling deployment
level: high
---
title: Suspicious Scripting Interpreter Download Cradle on Developer Endpoint
id: 2b3c4d5e-6f78-4a9b-8c0d-2e3f4a5b6c7d
status: experimental
description: Detects curl or wget piping remote content directly into a shell or scripting interpreter, a common staging technique for DPRK developer-targeting campaigns that deliver second-stage implants via trojanized setup or build scripts.
references:
  - https://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.t1059
logsource:
  category: process_creation
  product: macos
detection:
  selection_downloader:
    Image|endswith:
      - '/curl'
      - '/wget'
  selection_pipe:
    CommandLine|contains:
      - '| sh'
      - '| bash'
      - '| zsh'
      - '| python'
      - '| node'
  condition: all of selection_*
falsepositives:
  - Legitimate developer tool installers using curl-pipe-sh patterns (Homebrew, rustup, nvm)
level: medium
---
title: Node or Python Process Accessing SSH Keys or Cloud Credentials
id: 4d5e6f78-9a0b-4c1d-8e2f-3a4b5c6d7e8f
status: experimental
description: Detects scripting runtimes reading SSH private keys, AWS/Azure/GCP credential files, or Keychain-adjacent paths — consistent with credential harvesting observed after Jade Sleet implant deployment on developer machines.
references:
  - https://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.html
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1552.004
logsource:
  category: file_event
  product: macos
detection:
  selection_process:
    SourceImage|endswith:
      - '/node'
      - '/python'
      - '/python3'
      - '/ruby'
  selection_target:
    TargetFilename|contains:
      - '/.ssh/id_'
      - '/.aws/credentials'
      - '/.azure/'
      - '/.config/gcloud/'
      - '/.kube/config'
  condition: all of selection_*
falsepositives:
  - Legitimate dev tooling and SDKs reading cloud config during normal builds
level: high

KQL — Microsoft Sentinel / Defender

This hunt surfaces suspicious persistence and credential-access behavior on macOS and Windows developer endpoints enrolled in Defender for Endpoint. It looks for scripting processes creating LaunchAgent plists, download cradles, and access to credential stores — the observable core of the FLATROOF/ROOFDECK kill chain.

// Hunt for Jade Sleet-style developer workstation compromise: persistence + credential theft + staging cradles
let Lookback = 14d;
let SuspiciousInterpreters = dynamic(["node", "python", "python3", "ruby", "sh", "zsh", "bash", "curl", "wget"]);
let CredPaths = dynamic(["/.ssh/id_", "/.aws/credentials", "/.azure/", "/.config/gcloud/", "/.kube/config", "Login Data", "Cookies"]);
union isfuzzy=true
(DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ (SuspiciousInterpreters)
| where ProcessCommandLine has_any ("| sh", "| bash", "| zsh", "| python", "| node", "LaunchAgents", "id_rsa", ".aws/credentials")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, ReportId
),
(DeviceFileEvents
| where Timestamp > ago(Lookback)
| where FolderPath has_any ("/Library/LaunchAgents/", "/Library/LaunchDaemons/", "~/Library/LaunchAgents/")
| where FileName endswith ".plist"
| extend Suspicious = iff(InitiatingProcessFileName in~ (SuspiciousInterpreters), true, false)
| where Suspicious == true
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId
)
| order by Timestamp desc

Velociraptor VQL

Use this artifact across macOS (and Linux) developer fleets to enumerate recently created or modified persistence plists — the highest-fidelity artifact FLATROOF/ROOFDECK-style implants leave behind.

-- Hunt for recently modified LaunchAgent/LaunchDaemon persistence on macOS endpoints
LET plist_paths = SELECT FullPath, Mtime, Ctime, Size
FROM glob(globs=['/Library/LaunchAgents/*.plist',
                 '/Library/LaunchDaemons/*.plist',
                 '/Users/*/Library/LaunchAgents/*.plist'])
WHERE Mtime > now() - 1209600

SELECT FullPath,
       Mtime,
       Ctime,
       Size,
       read_file(filename=FullPath, length=4096) AS PlistHead
FROM plist_paths
ORDER BY Mtime DESC

Remediation / Triage Script — macOS Developer Endpoints

Run this on suspected or at-risk macOS developer machines to collect persistence artifacts, flag unsigned LaunchAgents, and audit credential exposure. It is read-only and safe for fleet-wide execution via your MDM.

#!/bin/bash
# jadesleet-triage.sh — macOS developer endpoint triage for FLATROOF/ROOFDECK-style persistence
# Run with sudo for full visibility. Read-only; writes report to /tmp.
REPORT="/tmp/jadesleet_triage_$(date +%Y%m%d_%H%M%S).txt"
echo "=== Jade Sleet macOS Triage Report: $(hostname) @ $(date) ===" > "$REPORT"

# 1. Enumerate LaunchAgents/LaunchDaemons and flag unsigned or recently modified plists
echo -e "\n[+] LaunchAgents/LaunchDaemons (last 30 days):" >> "$REPORT"
for dir in /Library/LaunchAgents /Library/LaunchDaemons ~/Library/LaunchAgents; do
  if [ -d "$dir" ]; then
    find "$dir" -name "*.plist" -mtime -30 -exec ls -la {} \; >> "$REPORT" 2>/dev/null
  fi
done

# 2. Check shell profile tampering (zshrc, bash_profile, npm/pip hooks)
echo -e "\n[+] Shell profiles modified in last 30 days:" >> "$REPORT"
find ~ -maxdepth 1 \( -name ".zshrc" -o -name ".bash_profile" -o -name ".zprofile" \) -mtime -30 >> "$REPORT" 2>/dev/null

echo -e "\n[+] Suspicious lines in shell profiles (curl/pipe/base64/eval):" >> "$REPORT"
grep -nEi 'curl|wget|\| *sh|\| *bash|base64|eval' ~/.zshrc ~/.bash_profile ~/.zprofile 2>/dev/null >> "$REPORT"

# 3. Flag unsigned or unnotarized running binaries
#    (implants are frequently unsigned ad-hoc builds)
echo -e "\n[+] Processes running unsigned executables:" >> "$REPORT"
ps aux | awk '{print $11}' | grep -E '^/' | sort -u | while read -r bin; do
  if [ -f "$bin" ]; then
    sig=$(codesign -dv "$bin" 2>&1)
    if echo "$sig" | grep -q "code object is not signed"; then
      echo "UNSIGNED: $bin" >> "$REPORT"
    fi
  fi
done

# 4. Audit credential exposure — SSH keys and cloud CLI tokens present on the box
echo -e "\n[+] Credential material present (verify need-to-have):" >> "$REPORT"
ls -la ~/.ssh/ 2>/dev/null >> "$REPORT"
ls -la ~/.aws/credentials ~/.config/gcloud 2>/dev/null >> "$REPORT"

echo -e "\n[+] Recent outbound connections from scripting runtimes (node/python):" >> "$REPORT"
lsof -i -P -n 2>/dev/null | grep -Ei 'node|python|ruby' >> "$REPORT"

echo -e "\n=== Triage complete. Review $REPORT and escalate anomalies to IR. ==="

Remediation and Hardening Guidance

There is no patch for this threat — there is only discipline. Prioritize the following, in order:

1. Contain any suspected compromise immediately. Isolate the developer workstation from the network, revoke all credentials accessible from it (SSH keys, cloud CLI tokens, CI/CD service accounts, VPN, source control PATs), and acquire a forensic image before reimaging. Jade Sleet's objective is downstream pivoting; assume every secret on the box is burned.
2. Audit downstream trust. Review the affected developer's access to build systems, artifact registries, code signing keys, and customer environments over the preceding 90 days. Small IT providers are targeted because of the customers behind them — notify downstream parties per your contractual and regulatory obligations.
3. Enforce hardware-backed phishing-resistant MFA (FIDO2/passkeys) on source control, CI/CD, cloud consoles, and email. DPRK campaigns routinely defeat push-based MFA via social engineering and token theft.
4. Segment developer workstations from production and customer infrastructure. No direct production database access, no standing cloud admin credentials on endpoints, and short-lived just-in-time elevation for anything sensitive.
5. Gate third-party code execution. Require developer review of any "coding assessment" or recruiter-supplied repository before running install/build scripts — ideally inside an isolated VM or cloud dev environment with no corporate credentials. Deploy dependency firewalling (e.g., artifact proxying with allowlists) for npm, PyPI, and other registries.
6. Deploy macOS endpoint detection with persistence visibility. Confirm your EDR monitors LaunchAgents/LaunchDaemons file creation, shell profile modification, and unsigned binary execution — then onboard the Sigma/KQL/VQL content above.
7. Train developers on the recruitment lure specifically. Generic phishing training does not cover a polished fake CTO conducting a three-week interview process. Brief engineering teams on Jade Sleet's recruitment and coding-test lures explicitly, and give them a no-blame reporting channel for suspicious outreach.
8. Monitor for the IOCs and TTPs in SentinelOne's full technical write-up and cross-reference against your telemetry retroactively for the disclosure window.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub