North Korean hackers target IT firm with macOS backdoors

North Korean threat actor Jade Sleet has been linked to the compromise of an Indian IT services organization, once again demonstrating the group's focus on targeting developers to infiltrate target networks. The campaign utilized Apple macOS backdoors known as FLATROOF and ROOFDECK, which were previously seen in attacks on the Web3 sector, with further coverage provided by The Hacker News.

The Jade Sleet actor, also known by aliases such as TraderTraitor, employed social engineering tactics, using job interview lures to target individuals in DevOps, cryptocurrency, and financial technology roles. Attackers posed as legitimate companies, creating fake GitHub repositories with malicious Terraform dependency lock files. When developers ran the "terraform init" command, their systems downloaded attacker-controlled modules. This led to the deployment of two Rust-based macOS backdoors: FLATROOF, which uses Telegram for command and control and can exfiltrate browser data and system information, and ROOFDECK, which uses the Nostr protocol for decentralized command and control, enabling system reconnaissance, file manipulation, and lateral movement. The compromise of an IT services provider in India, specifically a DevOps engineer's MacBook, was detected in March 2026, with an updated ROOFDECK variant deployed later that month.

Source: The Hacker News