Jade Sleet Targets DevOps Engineers with FLATROOF and ROOFDECK Backdoors

Jade Sleet, a North Korean threat actor also known as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899, has been linked to the compromise of an Indian IT services provider. The campaign targets developers in the DevOps and cryptocurrency sectors using sophisticated social engineering lures presented as job interview opportunities. The adversary distributes weaponized GitHub repositories containing malicious Terraform dependency lock files ('.terraform.lock.hcl'). When developers execute 'terraform init', these files force the platform to download and execute attacker-controlled modules from malicious registry domains.

Following initial access, the attackers deploy two Rust-based macOS implants: FLATROOF (Gaslight), which utilizes Telegram for C2 and browser data theft, and ROOFDECK, which leverages the Nostr protocol for decentralized C2, lateral movement, and persistence via Launch Agents. These tools are designed to target Apple Silicon architectures and implement complex evasion techniques, including the use of updated binaries that strip symbols to circumvent detection.

Attack Chain

1. Attacker establishes contact with a target developer via social engineering lures posing as a job interview opportunity.
2. Target is directed to a malicious GitHub repository (e.g., 'terraform-candidate-repo') containing a weaponized '.terraform.lock.hcl' file.
3. Developer executes 'terraform init' in their local environment, triggering the download of malicious modules from 'registry.hashicorp-aws[.]com'.
4. The malicious modules execute on the developer's macOS machine, establishing the initial foothold.
5. Attacker deploys FLATROOF for reconnaissance, capturing browser data, keychain credentials, and shell histories.
6. Attacker deploys ROOFDECK to establish persistent C2 via Launch Agents, signed with a private key to verify command integrity.
7. Attacker uses ROOFDECK to perform lateral movement and exfiltrate sensitive cloud, pipeline, and source code credentials.

Impact

Successful compromise allows the actor to gain deep access into corporate DevOps environments, source code pipelines, and cloud infrastructure. Victims are typically individual engineers, but the final objective involves credential exfiltration and unauthorized access to the target organization's sensitive technical assets. Previous activity by this group has resulted in multi-million dollar cryptocurrency thefts and supply chain compromises.

Recommendation

1. Block the domain 'registry.hashicorp-aws[.]com' at the DNS and proxy level.
2. Implement strict monitoring for 'terraform init' commands originating from non-authorized directories or execution contexts.
3. Deploy detection for the creation of unauthorized Launch Agents on macOS endpoints using the Sigma rule provided below.
4. Educate developers on the risks of executing 'terraform init' within untrusted repositories and verify the hash integrity of dependencies.