North Korean Hackers Turn Terraform Job Tests Into a Path Toward Developer Networks

Jade Sleet breached a smaller Indian technology supplier

SentinelOne has attributed the compromise of an India-based IT services provider to Jade Sleet, a North Korean threat group known for targeting cryptocurrency businesses and their suppliers. The intrusion centered on an Apple Silicon MacBook assigned to a DevOps engineer.

The victim was significantly smaller than organizations previously associated with the actor. That difference matters because it shows Jade Sleet is not limiting its operations to prominent blockchain platforms. Smaller providers can offer indirect access to customers, development infrastructure and privileged technical relationships.

Jade Sleet is also tracked as PUKCHONG, Slow Pisces, TraderTraitor and UNC4899. Its operations have historically focused on cryptocurrency theft, but developers and third-party vendors are recurring targets because their systems may hold credentials or access to higher-value environments.

The attackers deployed two Rust-based macOS backdoors, FLATROOF and ROOFDECK. FLATROOF is also known as Gaslight. Both implants had previously appeared during the March-April 2026 compromise of KelpDAO’s LayerZero bridge, and SentinelOne found the Indian victim while hunting for the same malware.

There is no CVE identifier or formal severity score associated with this incident. It is an intrusion campaign based on social engineering and malicious developer content, not a disclosed vulnerability in Terraform, Cursor or macOS.

Fake recruitment projects conceal the initial trap

The campaign approaches developers and job seekers with apparently legitimate technical recruitment exercises. GitHub repositories are built to resemble coding assignments or infrastructure-engineering projects connected to the employer being impersonated.

Observed repository names include:

• gtn-candidate-repo
• Northwind-IAC
• novacart-interview
• terraform-candidate-repo

The themes are selected to fit the target’s professional role. A DevOps or infrastructure candidate may therefore see Terraform configuration, cloud automation or deployment work that appears normal for a technical assessment.

The malicious element is a Terraform dependency lock file named .terraform.lock.hcl. It points toward infrastructure controlled by the attackers, including registry.hashicorp-aws[.]com. When a target runs terraform init, Terraform can retrieve attacker-controlled modules.

This technique exploits trust in the assignment rather than a confirmed flaw in Terraform. The developer voluntarily opens the project and performs a standard initialization step, while the repository’s dependency configuration redirects part of that process toward hostile infrastructure.

SentinelOne found that the packages were customized for individual victims and used in development environments prepared for one engineer at a time. Such tailoring reduces the value of broad detections based only on common file hashes or identical repository contents.

Investigators have not determined precisely how the malware reached the DevOps engineer’s MacBook. The malicious Terraform mechanism is part of the wider campaign, but the available evidence does not establish the exact delivery sequence for this victim.

Dormant implants activated through a developer workspace

FLATROOF and ROOFDECK were present on the engineer’s system by March 18, 2026. They remained inactive until March 29, when they began beaconing and interacting with the host.

The first recorded launches came from Cursor within seconds of the developer opening a workspace named cloudshield at:

~/DevOps-Automation/cloudshield

That timing connects execution to the developer’s normal workflow. However, it does not prove which workspace component, dependency or automated action launched the implants.

A newer ROOFDECK build was installed on April 20, 2026, one day after LayerZero publicly acknowledged the KelpDAO incident. The updated implant removed the existing ROOFDECK and FLATROOF binaries from the MacBook.

It also arrived without symbols and debugging information. Stripping those elements gives defenders less forensic context and makes reverse engineering more difficult, suggesting that the operators were actively refining their tooling after public exposure of the earlier operation.

The sequence also supports the assessment that ROOFDECK is a follow-on implant. Rather than necessarily providing initial access, it appears to be deployed after an attacker has established a foothold and wants more durable control.

FLATROOF steals data while ROOFDECK expands control

FLATROOF is a Rust backdoor designed for ARM-based macOS systems. It communicates through Telegram and supports remote command execution, uploads and downloads.

A Python component enables broader collection from the host. The malware can obtain data from Chrome, Brave, Firefox and Safari, steal Terminal command histories, enumerate installed applications, collect hardware and software details, and capture a snapshot of running processes.

It can also copy login.keychain-db. On a developer workstation, those capabilities could expose authentication material, browser sessions, cloud access, internal service details and commands previously used for administration.

ROOFDECK is also written in Rust and targets ARM-based Macs, but it uses the Nostr protocol for decentralized command and control. It provides reconnaissance, remote shell access, file manipulation, lateral-movement functions and persistence through macOS Launch Agents.

Commands sent to ROOFDECK are signed with the operator’s private key. The implant contains a public key that it uses to verify command integrity before acting, limiting the ability of unauthorized parties to issue instructions through the same communications channel.

Its functions are divided into separate command handlers. ROOFDECK also implements numerous directory and file operations internally instead of depending entirely on standard shell utilities installed on the Mac. SentinelOne compared that design approach with Lazarus’s LightlessCan tooling.

Together, the implants offer complementary capabilities: FLATROOF emphasizes collection and data theft, while ROOFDECK provides a durable environment for shell access, persistence and movement beyond the original endpoint.

A developer Mac can expose far more than one workstation

The immediate victim is the engineer whose Apple Silicon MacBook was compromised. The wider risk extends to every environment that trusted that device.

DevOps endpoints commonly interact with source-control systems, cloud management consoles, CI/CD platforms, package registries and infrastructure-as-code repositories. They may also contain deployment tokens, SSH material, browser sessions and configuration files that are unavailable to ordinary corporate users.

A compromised IT provider introduces an additional supply-chain concern. Access obtained from one supplier could potentially be used against downstream customers, although no specific customer compromises have been disclosed in this case.

Jade Sleet’s history helps explain the choice of target. GitHub stated in July 2023 that the actor pursued cryptocurrency and blockchain users as well as suppliers serving those organizations. In early 2025, the group was associated with the theft of approximately $1.5 billion from Bybit’s cold-wallet infrastructure following a compromise of Safe{Wallet}’s developer environment.

The newly attributed Indian IT provider intrusion follows the same strategic logic: reach valuable assets by first compromising people and systems involved in building, operating or supporting them.

What development and security teams should inspect

Organizations should begin by reviewing .terraform.lock.hcl files and Terraform modules for unexpected dependencies, modified checksums and references to untrusted registries. Any appearance of registry.hashicorp-aws[.]com warrants investigation.

Security teams should correlate executions of terraform init with outbound connections from developer workstations. Repositories delivered through unsolicited interviews or recruitment conversations should be examined in an isolated environment before any build, initialization or dependency-installation command runs.

On Apple Silicon systems, defenders should hunt for:

• FLATROOF or Gaslight and ROOFDECK artifacts
• Unexpected Telegram-based command-and-control activity
• Nostr traffic inconsistent with normal business use
• Unrecognized macOS Launch Agents
• Suspicious processes started by Cursor
• Access to browser profiles, Terminal histories or login.keychain-db
• Collection of application inventories and process snapshots
• Backdoor binaries that were unexpectedly removed or replaced
• Unfamiliar executables stripped of symbols and debugging data

If a developer endpoint may have been compromised, organizations should rotate credentials and tokens available from that system. The response should cover cloud accounts, source control, CI/CD services, package registries and cryptocurrency-related systems rather than only the local macOS password.

Development networks should also be segmented from production, with lateral access restricted to what each role requires. Trusted registries, independent integrity checks, reproducible builds and mandatory review of dependency changes can reduce exposure to malicious technical assignments.

The central defensive assumption must change: a coding exercise is executable third-party content. It should receive the same scrutiny as any other untrusted software.