[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPG1_wrjsOLg8CBOLv6mRiBqa4hGMrWC5juaLQaQ8SqM":3},{"article":4,"iocs":56,"watch_terms":86,"solutions":87,"lesson":177},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"19ee6fb5-7ef3-46c9-803d-dbb08787c4be","Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors","jade-sleet-linked-to-indian-it-provider-breach-with-flatroof-and-roofdeck-backdo-7de863","The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based \"much smaller organization\" in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks. Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple","The North Korean threat actor Jade Sleet has been linked to a breach of an Indian IT services company, continuing its pattern of targeting developers. The attack involved the use of macOS backdoors, FLATROOF and ROOFDECK, previously seen in attacks on the Web3 sector. Jade Sleet, also known by other aliases, has a history of cryptocurrency heists and supply chain compromises.","North Korean threat actor Jade Sleet linked to Indian IT provider breach using macOS backdoors.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fjade-sleet-linked-to-indian-it-provider.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEi-xFiujwBJLdl6_4wZSMCWdeyCgev2EqszOLkIJ5I9Kbanu6YNmQ36nM615XmLQ-sq2aqldOHfl47jaMNRtDd80RT8k5f6I7eQuszf7wsIg49sEdMW36hsEKUtVUkZabRlGvvDxn7H7COmRCV8qP2pzQm9LNo5QKRnnptxmxTlJ8BMcPxuiqdaMjn-are0\u002Fs1600\u002Fit-services.jpg","2026-09-21T06:06:44+00:00","2026-09-21T08:00:22.708051+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"Jade Sleet","threat_actor",{"name":21,"type":22},"FLATROOF","product",{"name":24,"type":22},"ROOFDECK",{"name":26,"type":27},"SentinelOne","vendor",{"name":29,"type":30},"macOS","technology",{"name":32,"type":30},"Terraform","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,59,60,64,68,71,74,77,80,83],{"type":50,"value":21,"context":58},"macOS backdoor used in the attack.",{"type":50,"value":24,"context":58},{"type":61,"value":62,"context":63},"domain","registry.hashicorp-aws[.]com","Malicious domain used in weaponized Terraform dependency lock file.",{"type":65,"value":66,"context":67},"mitre_attack","T1059","Command and Execution (used by FLATROOF)",{"type":65,"value":69,"context":70},"T1071","Application Layer Protocol (used by FLATROOF for C2 via Telegram)",{"type":65,"value":72,"context":73},"T1105","Ingress Tool Transfer (used by FLATROOF for file upload\u002Fdownload)",{"type":65,"value":75,"context":76},"T1041","Exfiltration Over C2 Channel (used by FLATROOF for data theft)",{"type":65,"value":78,"context":79},"T1047","Windows Management Instrumentation (used by ROOFDECK for system reconnaissance)",{"type":65,"value":81,"context":82},"T1547","Boot or Logon Autostart Execution (used by ROOFDECK for persistence via Launch Agents)",{"type":65,"value":84,"context":85},"T1560","Archive Collected Data (used by ROOFDECK for data collection)",[26,21,24],{"controls":88,"vendors":173},[89,117,144],{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,109],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":103,"vendor_name":26,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sentinelone","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":118,"name":119,"problem":120,"products":121},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[122,130,137],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":131,"product_name":134,"url":135,"description":136},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":118,"product_name":141,"url":142,"description":143},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"slug":145,"name":146,"problem":147,"products":148},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[149,157,165],{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":166,"vendor_name":167,"vendor_logo":168,"product_slug":169,"product_name":170,"url":171,"description":172},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[174],{"slug":103,"name":26,"logo_path":104,"roles":175},[176],"reported_by",{"slug":178,"title":179,"body":180,"framework_refs":181,"framework_notes":194},"north-korean-jade-sleet-backdoors-indian-it-provider-via-macos-malware","North Korean Jade Sleet Backdoors Indian IT Provider via macOS Malware","Jade Sleet, a North Korean state-sponsored threat actor, compromised an Indian IT services company using sophisticated macOS backdoors (FLATROOF and ROOFDECK), continuing a pattern of targeting developers and technology supply chains. The breach highlights how attackers leverage trusted IT vendors as pivot points to reach downstream clients, including high-value targets in the Web3 and cryptocurrency sectors. By focusing on developers and IT service providers, adversaries can implant malware that propagates through legitimate software delivery pipelines. This matters because a single compromised IT provider can expose dozens or hundreds of client organizations to nation-state level threats.",[182,183,184,185,186,187,188,189,190,191,192,193],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","CIS Control 15: Service Provider Management","NIST SP 800-161: Supply Chain Risk Management","NIST CSF DE.CM-3: Personnel activity is monitored","NIST CSF ID.SC-2: Suppliers and third-party partners assessed for risk","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","MITRE ATT&CK T1195: Supply Chain Compromise","MITRE ATT&CK T1543: Create or Modify System Process (Persistence)","ISO\u002FIEC 27036: Information Security for Supplier Relationships",{}]