{"id":1872,"date":"2026-09-22T11:23:56","date_gmt":"2026-09-22T05:53:56","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1872"},"modified":"2026-09-24T09:49:04","modified_gmt":"2026-09-24T04:19:04","slug":"jade-sleet-flatroof-roofdeck-devops-macos","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/jade-sleet-flatroof-roofdeck-devops-macos\/","title":{"rendered":"Jade Sleet FLATROOF and ROOFDECK: Securing DevOps Macs Against Backdoors"},"content":{"rendered":"

Introduction<\/h2>\n

A coding assignment can look like routine work to an engineer who builds infrastructure every day.<\/p>\n

Research published on September 18, 2026, linked an Indian IT provider\u2019s compromised Mac to the Jade Sleet FLATROOF and ROOFDECK backdoors. Related activity used recruitment lures and weaponized development projects, but investigators could not confirm this device\u2019s original infection route.<\/p>\n

The case raises a practical question: what could someone reach after gaining control of a developer\u2019s laptop?<\/p>\n \t\t

\r\n \t\t\tWho is Jade Sleet?<\/span> \t\t\t \t\t\t\t

\r\n \t\t\t\t\tJade Sleet is a North Korea-linked threat actor also known as TraderTraitor, PUKCHONG, and UNC4899. Its targeting includes cryptocurrency and blockchain organizations, along with vendors serving those businesses.<\/p>\n

The group impersonates recruiters or developers to build trust with technical employees. It then encourages targets to download repositories or run software containing malicious dependencies. These approaches turn familiar collaboration activities into opportunities for malware execution.<\/p>\n

FLATROOF (also known as Gaslight) and ROOFDECK previously featured in the KelpDAO bridge attack involving compromised LayerZero Labs infrastructure. Attackers deployed both macOS backdoors on a LayerZero developer\u2019s device during the intrusion.<\/p>\n

Its activity matters beyond cryptocurrency because technology vendors can hold valuable access to other organizations. For security teams, the relevant warning signs include unsolicited development invitations, unfamiliar dependencies, and requests to execute code during recruitment. Assess those requests independently of how convincing the sender\u2019s profile appears. \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n

What happened?<\/h2>\n

The incident involved an Apple Silicon MacBook belonging to a DevOps engineer at an India-based IT services provider without cryptocurrency ties.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Area<\/th>\nVerified details<\/th>\n<\/tr>\n<\/thead>\n
Timeline<\/td>\nBoth backdoors were present by March 18, 2026. Observed execution began March 29; command-and-control activity continued into June.<\/td>\n<\/tr>\n
Execution<\/td>\nCursor launched the implants within seconds of opening the ~\/DevOps-Automation\/cloudshield<\/code> workspace. This does not establish a vulnerability in Cursor.<\/td>\n<\/tr>\n
Campaign lure<\/td>\nRelated GitHub projects posed as infrastructure engineering assessments and contained weaponized .terraform.lock.hcl<\/code> files referencing attacker-controlled provider registries.<\/td>\n<\/tr>\n
FLATROOF<\/td>\nAlso called Gaslight, it supports command execution and collection of browser data, terminal history, system details, and a copy of login.keychain-db<\/code>.<\/td>\n<\/tr>\n
ROOFDECK backdoor<\/td>\nSupports remote shells, file operations, reconnaissance, and Launch Agent persistence. It uses the Nostr protocol for decentralized command-and-control address discovery. Before executing commands, it verifies the operator\u2019s cryptographic signatures using an embedded public key.<\/td>\n<\/tr>\n
Evidence limits<\/td>\nInitial delivery remains unconfirmed. The report does not establish MFA bypass or downstream customer compromise.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

These findings distinguish observed endpoint activity from the wider campaign\u2019s delivery methods.
\n

<\/div>

Why Zero-Touch Enrollment Matters for Device as a Service Deployments<\/h4>

Zero-touch enrollment streamlines DaaS deployments, reduces IT workload and standardizes device setup.<\/p><\/div><\/div><\/div><\/a><\/div><\/div><\/div><\/p>\n

Why the Terraform dependency matters<\/h3>\n

Terraform providers are executable plugins; modules are reusable infrastructure configurations. Calling both \u201cprovider modules\u201d obscures that distinction.<\/p>\n

During terraform init<\/code>, Terraform installs required providers using configuration requirements and recorded lock-file selections. Checksums help verify package consistency, but an unfamiliar lock file does not establish that its selected dependencies are trustworthy. Before executing terraform init<\/code>, inspect .terraform.lock.hcl<\/code> for unofficial provider registry hostnames and verify their legitimacy.<\/p>\n

Review provider addresses, publishers, configuration files, and lock-file changes before initializing an external project. Treat a dependency review as a security decision, even when the project arrives through a plausible interview process.<\/p>\n

Why this matters<\/h2>\n

Developer endpoints deserve protection based on the access they hold. A laptop used for infrastructure administration may provide routes into source repositories, deployment systems, or cloud resources.<\/p>\n

Consequently, a DevOps compromise can create exposure beyond local files. The actual impact depends on credential permissions, session validity, network access, and controls around connected services. Treat downstream access as something to investigate, rather than assume.<\/p>\n

Patching remains necessary, but teams must also address users executing untrusted code through legitimate tools. Similarly, successful authentication does not establish that every process running afterward is safe.<\/p>\n

Effective macOS developer endpoint security therefore needs several layers: controlled software use, limited privileges, dependency review, endpoint monitoring, and access policies. Each layer addresses a different part of the workflow.<\/p>\n

How Hexnode can help<\/h2>\n

Hexnode can support the device-management and endpoint-response parts of this approach. Dependency validation and cloud permission reviews remain separate responsibilities.<\/p>\n

Hexnode UEM: Control application access on developer Macs<\/h4>\n

Hexnode UEM<\/a> supports application allowlisting and blocklisting on managed macOS devices. Administrators can define permitted applications or restrict access to selected apps, subject to agent and policy requirements.<\/p>\n

For development teams, use these controls to establish an approved toolset and restrict unnecessary applications. Test policies against real engineering workflows before broad deployment.<\/p>\n

Application controls should not be presented as a universal script or dependency filter. Allowlisting an IDE permits its normal code-execution workflows; it does not validate code or dependencies executed within that context. Dependency security requires isolation alongside application allowlisting. Run untrusted assessments in disposable, isolated environments without corporate credentials, mounted work directories, or access to production infrastructure. Teams still need procedures for reviewing external repositories and separating untrusted assessments from corporate access.
\n

\n
\n
\n
\n \"macOS_thumbnail\"\n <\/div>\n <\/div>\n
\n
\n Featured Resource \n <\/h5>\n

\n macOS Platform Capability Statement\n <\/h4>\n

\n Download the infographic to explore how Hexnode simplifies macOS device management across every stage of the endpoint lifecycle.\n <\/p>\n \n Get the infographic\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section> <\/p>\n

Hexnode UEM: Bring device compliance into access decisions<\/h4>\n

Hexnode UEM can evaluate configured device requirements, including supported operating systems, encryption, and application checks. Through its supported integration with Microsoft Entra ID, Hexnode can supply device compliance information for Conditional Access decisions. Microsoft Entra ID enforces the configured access policy.<\/p>\n

Apply this approach to sensitive applications where the platform and integration support it. Validate coverage for each repository service and cloud console.<\/p>\n

Compliance helps establish a device baseline. It does not certify that a workstation is malware-free or automatically revoke every credential exposed through it.<\/p>\n

Hexnode XDR: Investigate suspicious development activity<\/h4>\n

Hexnode XDR<\/a> supports endpoint investigation and response across Windows and macOS. Its documented response capabilities include device isolation, process termination, and file quarantine.<\/p>\n

For this threat pattern, prioritize monitoring parent-child process relationships where development IDEs spawn unrecognized command-line utilities or Rust binaries. Confirm that the available endpoint telemetry exposes the required process relationships before configuring these hunts. Investigate unexpected executable paths, command arguments, persistence changes, and outbound connections alongside the process activity.<\/p>\n

Treat these patterns as investigation leads: legitimate engineering workflows also launch command-line tools and compiled binaries. Evaluate them against approved development activity before taking containment action.<\/p>\n

Strengthen developer workflows before the next assignment<\/h2>\n

Start by identifying developer devices with production access. Record which repositories, cloud roles, deployment systems, and secrets each device can reach. Reduce unnecessary permissions and avoid keeping production credentials in environments used for external coding assessments.<\/p>\n

Next, require review of unfamiliar repositories, provider sources, and lock files before execution. Run approved external assessments in isolated environments without corporate credentials, shared sensitive folders, or production connectivity. Give employees a clear way to report suspicious recruitment requests.<\/p>\n

If compromise is suspected, isolate the endpoint and preserve evidence. Review connected accounts, revoke affected sessions and tokens, and rotate exposed credentials from a trusted device. Investigate repository and deployment changes before restoring access.<\/p>\n

Hexnode UEM and Hexnode XDR can support this work through application controls, device compliance, investigation, and containment. Begin with the developer Macs that hold the broadest access, then verify that their permissions match current responsibilities.
\n

<\/div><\/div>
Try\u202fHexnode\u202fFree for 14 Days\u202f\u202f\u202f<\/h5>

Sign up for Hexnode to strengthen developer device security and reduce risks across your macOS fleet.<\/p>