Jade Sleet Attributed to India IT Provider Breach Deploying FLATROOF and ROOFDECK Backdoors

According to SentinelOne, the North Korean threat actor Jade Sleet has been linked to the compromise of an India-based "much smaller organization" within the information technology services industry. The attack is notable for its focus on developers, a recurring tactic for Jade Sleet to breach target networks.

The investigation revealed the deployment of two previously documented backdoors, FLATROOF and ROOFDECK, on the compromised infrastructure. Additionally, the threat actor employed Apple-related lures or tools as part of the intrusion chain, though specific technical details regarding the Apple components were not fully disclosed in the initial summary.

The compromise of the IT provider serves as a supply-chain vector, potentially allowing Jade Sleet to extend access to the developer networks of the provider's clients. SentinelOne's disclosure highlights the persistent adaptability of North Korean cyber operations in targeting the software development supply chain.