North Korean state-sponsored threat group Jade Sleet (tracked in commercial intelligence as UNC1069) compromised an Apple Silicon MacBook assigned to a senior DevOps engineer at an Indian IT services provider. According to comprehensive technical telemetry published by SentinelLabs, the adversaries gained a high-privilege foothold designed to serve as an operational conduit into downstream enterprise client networks and cloud production pipelines.
During the intrusion, the operatives deployed two novel, architecturally sophisticated tools developed entirely in the Rust programming language: FLATROOF and ROOFDECK. The transition toward Rust reflects a persistent industry trend among nation-state operators, capitalizing on memory safety, aggressive compiler optimizations, and native multi-architecture support that complicates static disassembly and behavioral antivirus heuristics.
FLATROOF operates as a specialized reconnaissance and credential harvesting module engineered specifically for the macOS ecosystem. It systematically extracts sensitive developer artifacts: browser session cookies, credentials, local SSH keys, shell histories from Bash and Zsh profiles, and credential records stored within the macOS Keychain. Extracted telemetry is compressed, encrypted, and exfiltrated to adversary staging points.
The secondary component, ROOFDECK, provides persistent remote backdoor access and interactive shell management. Most notably, ROOFDECK features an innovative command-and-control (C2) transport architecture. Rather than relying upon static domain structures or centralized hosting infrastructure, ROOFDECK utilizes the decentralized Nostr protocol. By establishing WebSocket connections to public Nostr relay nodes, the backdoor ingested encrypted operational commands without triggering perimeter firewall anomalies.
Jade Sleet has established a track record targeting IT consultancies, cryptocurrency entities, and technology supply chains to generate revenue for sanctioned state regimes or harvest proprietary code. By targeting developer endpoints directly, the adversary illustrates how local workstations remain the premier vector for breaching hardened enterprise cloud infrastructure.
Actionable Guidance for IT and Security Teams
- Inspect macOS Endpoints for Rust Binaries: Hunt for unsigned Mach-O binaries executing from `/tmp/`, `/Users/Shared/`, or configured within unauthorized LaunchAgent persistence scripts.
- Filter Decentralized WebSocket Telemetry: Monitor and restrict outbound WebSocket traffic originating from developer subnets toward public Nostr relays and decentralized transport nodes.
- Harden Local Developer Secrets: Prohibit static API credentials, long-lived AWS tokens, and unencrypted SSH keys on developer drives; enforce hardware-bound tokens (FIDO2) for cloud access.
- Implement Strict Zero Trust Network Isolation: Segregate development laptops from production environments and mandate secure jump hosts for infrastructure modifications.
Evidence Status
- Confirmed: SentinelLabs published concrete indicators of compromise (IoCs), reverse-engineered the Rust binaries, and validated the Nostr C2 mechanism.
- Reported: Independent threat researchers correlated toolsets and operational tradecraft with historic DPRK state-sponsored intrusions.
- Unconfirmed: The full extent of lateral movement into client environments serviced by the Indian vendor remains under active investigation.
In Brief
- North Korean threat actor Jade Sleet compromised a DevOps engineer's Mac at an Indian IT services provider.
- Deployed two novel Rust-based implants: FLATROOF for credential harvesting and ROOFDECK for persistent access.
- ROOFDECK leveraged the decentralized Nostr protocol to bypass enterprise perimeter egress controls.