Inside Jade Sleet’s MacBook Intrusion: How North Korean Hackers Weaponized Terraform Against an Indian IT Provider

The Strategic Pivot Beyond Cryptocurrency Protocols

For several years, the playbook for North Korea’s state-sponsored cyber operations followed an unmistakable pattern. If an organization held a cryptocurrency treasury, ran a decentralized bridge, or maintained high-volume hot wallets, it was firmly in the crosshairs of Pyongyang's financial hacking apparatus. If it operated as a conventional software consultancy or regional managed IT provider, security teams generally assumed their risk was limited to commodity ransomware or indiscriminate scanning.

That assumption is dangerously outdated.

A forensic investigation published by SentinelLabs researchers[1] revealed that the Democratic People’s Republic of Korea (DPRK) threat actor tracked as Jade Sleet (also known across government and private sectors as TraderTraitor, UNC4899, Slow Pisces, and PUKCHONG) successfully breached an IT services provider based in India. The victim firm maintained zero cryptocurrency holdings. It managed no token bridges. It had no direct exposure to Web3 assets.

Instead, the prize was a single endpoint: an Apple Silicon MacBook assigned to a senior DevOps engineer. That machine held administrative credentials, Infrastructure-as-Code (IaC) configuration pipelines, and active API access spanning Amazon Web Services (AWS), OVH, and OpenStack environments. In modern distributed architectures, a compromised DevOps laptop is effectively an unsegmented root key to multi-cloud enterprise estates. By manipulating how developers trust third-party software dependencies, Jade Sleet bypassed macOS Gatekeeper protections, embedded custom native ARM64 implants, and operated undetected inside the firm for months.

Actor Background: Who Is Jade Sleet?

Understanding the severity of this intrusion requires examining the threat actor's pedigree. Jade Sleet operates under the Reconnaissance General Bureau (RGB), the primary foreign intelligence service of North Korea. In early 2022, the U.S. Cybersecurity and Infrastructure Security Agency published a comprehensive joint cybersecurity advisory on TraderTraitor[2], detailing how state-sponsored actors deploy bespoke malware against technical personnel via social engineering campaigns disguised as recruitment overtures.

The group does not operate like a traditional criminal extortion ring. They do not deploy loud file encryptors or post ransom threats on darknet leak portals. Their methodology is patient, highly targeted, and technically sophisticated. In December 2024, the Federal Bureau of Investigation formally attributed[3] the theft of $308 million from Japan-based DMM Bitcoin to TraderTraitor, noting that initial compromise occurred through developer-targeted social engineering. Months later, in spring 2026, the group struck again, manipulating infrastructure associated with LayerZero and KelpDAO to siphon approximately $292 million in digital assets.

Across these operations, researchers identified a recurring signature: the deployment of two specialized macOS implants written natively in Rust: FLATROOF (frequently tracked as macOS.Gaslight) and ROOFDECK. When SentinelLabs discovered these exact implants running silently on the MacBook of an engineer at an Indian IT provider with no cryptocurrency ties, the broader strategic intent became clear. North Korea is pursuing downstream software supply chain access to establish footholds in third-party managed environments.

The Delivery Trap: How `.terraform.lock.hcl` Exploited Developer Trust

The initial infection vector was not a zero-day vulnerability in macOS or an unauthenticated remote exploit. It was something far simpler and more effective: exploitation of normal developer workflow conventions. Threat research teams at Palo Alto Networks Unit 42[4] have tracked how Jade Sleet (under the moniker Slow Pisces) routinely constructs sophisticated online personas posing as headhunters, recruiters, or engineering executives representing tech firms.

In this campaign, the lure took the form of a technical employment assessment. The threat actor provided the DevOps engineer with access to a GitHub repository containing take-home Infrastructure-as-Code exercises. SentinelLabs identified multiple repository names associated with this campaign cluster, including Northwind-IAC, novacart-interview, and terraform-candidate-repo. The engineer was asked to review the Terraform manifests, resolve infrastructure misconfigurations, and demonstrate how they would provision the simulated environment.

The Mechanics of Lockfile Poisoning

The core danger of this attack stems from how Terraform manages third-party providers. When a project is initialized, Terraform looks for a dependency lockfile named .terraform.lock.hcl. This file is intended to ensure reproducible builds across teams by recording the exact provider source address, version constraints, and cryptographic checksums.

When an engineer clones a repository and runs terraform init, Terraform checks the lockfile first. If a provider is specified in the lockfile with a specific registry hostname, Terraform does not query HashiCorp's default public registry (registry.terraform.io). It honors the lockfile instructions and fetches the provider binary directly from the declared endpoint.

Jade Sleet crafted lockfiles where common providers—specifically the AWS provider plugin—were mapped to attacker-controlled, typosquatted hostnames:

• registry.hashicorp-aws[.]com
• registry.hashicorp-aws[.]io
• registry.hashicorp-terraform[.]io

To an engineer accustomed to seeing terminal scrolling text during a routine terraform init run, nothing looked out of place. The CLI displayed standard progress indicators, pulled the plugin from the typosquatted host, verified that the SHA-256 hashes matched the malicious lockfile, and immediately executed the plugin binary to query its schema. In that single, unprompted execution, the threat actor secured arbitrary code execution on an Apple Silicon Mac.

Notably, SentinelLabs observed that during another candidate's interview session, an alert engineer spotted the unusual provider URL in the lockfile, stripped the rogue domain, and committed a note documenting the anomaly. But on the Indian IT provider’s workstation, the poisoned lockfile executed as planned.

Dual-Implant Architecture: FLATROOF vs. ROOFDECK

Once execution was achieved, Jade Sleet did not rely on generic, public off-the-shelf post-exploitation frameworks. Instead, they deployed two specialized, tightly coupled implants written in Rust and compiled natively for ARM64 macOS architecture. The division of responsibilities between these tools demonstrates an acute understanding of how modern macOS endpoint telemetry operates.

Stage 1: FLATROOF (macOS.Gaslight)

The initial staging implant, FLATROOF, was written to disk under the path ~/Library/com.apple.iTunesCloud/SystemUpdate. Its core mission was reconnaissance, host environment validation, and clearing security roadblocks for the interactive backdoor.

When files are downloaded via a web browser or communication client on macOS, the operating system applies the com.apple.quarantine extended attribute, triggering Gatekeeper verification upon execution. However, because FLATROOF had already gained execution via the developer's terminal environment during the terraform init sequence, it possessed the user-space privileges needed to manipulate file attributes directly.

FLATROOF dropped the second-stage payload (ROOFDECK) to disk and immediately executed:

/usr/bin/xattr -d com.apple.quarantine ~/Library/com.apple.internal.ck/iSync
/bin/chmod +x ~/Library/com.apple.internal.ck/iSync

By stripping the quarantine attribute, FLATROOF bypassed Gatekeeper entirely. When ROOFDECK subsequently launched, macOS treated it as a trusted local binary, displaying no verification prompts or security dialogues to the user.

According to reporting by The Hacker News[5], FLATROOF then unpacked an embedded Python collection module. This script performed a broad sweep of the developer’s local environment:

• Harvesting credential databases and session cookies from Chrome, Brave, Firefox, and Safari.
• Copying the user's primary credential vault: ~/Library/Keychains/login.keychain-db.
• Parsing shell history files (.bash_history, .zsh_history), capturing inline API tokens, internal SSH destination IPs, and staging server passwords.
• Taking snapshots of running processes (ps aux) and gathering hardware configuration details via system_profiler.

For data exfiltration, FLATROOF eschewed dedicated staging servers, instead transmitting the collected credentials directly to an attacker-operated Telegram bot via the legitimate Telegram Bot API. By using trusted cloud infrastructure, the exfiltration blended into ordinary outbound HTTPS traffic, raising zero alerts on perimeter firewalls.

Stage 2: ROOFDECK (Interactive Post-Exploitation)

While FLATROOF acted as the gatherer and stager, ROOFDECK was the command center. Dropped under the decoy name iSync into ~/Library/com.apple.internal.ck/iSync, ROOFDECK is a full-featured, persistent macOS backdoor.

To blend into system telemetry, ROOFDECK spawned itself with a hardcoded command-line parameter: --type=renderer. To a security operations analyst reviewing process trees, the process closely mimicked the legitimate helper threads spawned by Chromium-based browsers or Electron applications such as Slack, Discord, or VS Code.

ROOFDECK’s internal command parser provides operators with extensive host control:

Cryptographic Command Signing and Nostr C2 Dead-Drops

Two distinct technical features in ROOFDECK separate it from conventional malware.

First, ROOFDECK enforces strict RSA public-key signature verification on every incoming instruction. When the command-and-control server issues a task, the payload includes a cryptographic signature generated by the threat actor’s private key. ROOFDECK verifies this signature against an embedded RSA public key before parsing or executing the command. If a threat intelligence firm or law enforcement agency sinkholes the C2 infrastructure and attempts to issue commands or telemetry queries to the infected endpoint, ROOFDECK ignores the packets. The malware refuses to speak to anyone who does not hold the private key.

Second, the malware incorporates a dead-drop resolver built on top of the Nostr protocol. Nostr is an open, decentralized communication framework that relays JSON notes across decentralized servers. By publishing encrypted status updates to specific Nostr public keys, the operators can rotate their backend C2 domain names and IP addresses dynamically. ROOFDECK connects to public Nostr relays, pulls the latest encrypted profile note, extracts the active C2 hostname, and initiates communication. This completely neutralizes traditional IP or domain-based firewall blocks, as the actual operational infrastructure can be rotated without modifying the binary on disk.

Forensic Timeline: Dormancy, Discovery, and Disappearance

The forensic narrative reconstructed by SentinelLabs sheds light on how state-backed operators behave when managing compromised access across different geographic sectors.

The malware’s initial footprint appeared on the system as early as March 18, 2026. Yet for over a week, the implants remained completely passive. Telemetry captured the engineer utilizing the Cursor AI code editor for routine daily development. Then, on March 29, 2026, FLATROOF initiated communication. Rather than maintaining a standard periodic beacon, FLATROOF tied its operational window directly to Cursor IDE’s process lifecycle. When the engineer opened Cursor, the malware communicated; when Cursor was terminated, FLATROOF went dark. By syncing malicious network requests with normal developer work hours, the malware avoided triggering anomalous off-hours traffic alerts.

On April 13, 2026, the target cloned the malicious terraform-candidate-repo via GitHub Desktop. The following day, FLATROOF re-armed ROOFDECK, ensuring that persistence via a custom LaunchAgent was properly registered with launchd.

Then, the external environment shifted violently.

The Emergency Anti-Forensics Cleanup

On April 19, 2026, LayerZero publicly acknowledged the massive $292 million breach of KelpDAO, setting off an aggressive wave of threat hunting and incident response throughout the global cybersecurity sector. Threat researchers rapidly homed in on TraderTraitor infrastructure and associated malware hashes.

The impact was felt on the Indian IT provider’s workstation less than 24 hours later. At 13:15 UTC on April 20, 2026, ROOFDECK staged a new, third-stage executable disguised as loginwindow. Unlike previous implants, this binary was completely stripped of compiler paths, function symbols, and debugging metadata. Upon launch, the loginwindow binary immediately executed rm -f commands against the original FLATROOF and ROOFDECK binaries, purging them from disk to destroy forensic evidence.

For the next five weeks, this stripped binary maintained a low-frequency beacon to an external host (grenight[.]com). The operators rarely initiated interactive shell sessions. Finally, by June 2026, communications ceased completely. The threat actors disconnected and walked away without attempting to deploy ransomware or extort the business.

This exit underscores the operational calculation of state actors. Unlike cybercriminals who monetize every infected system with ransomware, Jade Sleet understood that once their operational cover was compromised by the LayerZero fallout, lingering on a workstation that held no direct crypto treasury carried too much risk. Maintaining active access on an IT firm’s laptop risked burning newly developed Rust tooling. They gathered what cloud tokens they could and severed the connection.

What Defenders Must Change

The breach of an Indian IT services provider demonstrates that developer workstations are high-value targets in modern supply chain intrusions. When a developer has permissions to pull arbitrary git repositories, initialize build tools, and store cloud management keys locally, standard endpoint antivirus is insufficient.

Defenders must institute four structural technical changes across their engineering environments:

1. Isolate Unvetted Code in Ephemeral Dev Containers: Engineering organizations must ban the practice of running take-home recruitment tests, open-source demonstration projects, or third-party repositories directly on company-provisioned machines. All external code must run inside isolated Docker containers, virtual machines, or cloud sandboxes (such as GitHub Codespaces) with zero access to the local Keychain, internal network interfaces, or local dotfiles.
2. Implement Strict Lockfile Auditing in CI/CD: Security pipelines must treat .terraform.lock.hcl, package-lock.json, and other lockfiles as sensitive configuration code. Automated linters should parse lockfiles on pull requests and reject any configuration specifying a provider or package source outside of approved enterprise registries (e.g., explicitly blocking any registry domain that is not registry.terraform.io).
3. Instrument EDR Telemetry for Gatekeeper Bypass Tactics: Endpoint detection tools on macOS fleets must alert on non-interactive invocations of /usr/bin/xattr that strip the com.apple.quarantine attribute, particularly when executed by shells spawned under IDEs like Cursor or VS Code. Furthermore, any creation of LaunchAgent plist files in ~/Library/LaunchAgents/ mimicking system binaries (such as loginwindow.plist) must trigger immediate automated host isolation.
4. Abolish Long-Lived Cloud Credentials: Static AWS access keys (AKIA...) stored in ~/.aws/credentials or shell environment variables are a primary target for threat actors. Organizations must migrate all cloud access to short-lived credentials generated via identity providers (such as AWS IAM Identity Center or Okta) with maximum session lifespans of one to two hours. Even if an adversary siphons local browser session cookies and Keychain databases, the tokens should expire before lateral movement can be established.

Security Takeaway

The Jade Sleet compromise of an Indian IT firm marks a significant evolution in North Korean cyber operations. While their strategic objective remains regime revenue generation, their tactical targeting has expanded from direct Web3 treasuries to the managed IT providers that configure global cloud infrastructure. By targeting developer trust through poisoned Terraform lockfiles and deploying native Apple Silicon Rust backdoors, Jade Sleet bypassed macOS Gatekeeper protections without needing a single zero-day.

For engineering leadership, the lesson is clear: if you do not secure the developer endpoints that build and manage your infrastructure, you cannot defend the cloud environments they control.