🕵️ RESEARCH & DEEP DIVES
North Korea's Jade Sleet Linked to Indian IT Provider Breach via FLATROOF and ROOFDECK macOS Backdoors
SentinelOne linked North Korean actor Jade Sleet to the compromise of an India-based IT services provider using FLATROOF and ROOFDECK macOS backdoors.- Targets: developers and IT/crypto/fintech staff, including a DevOps engineer at an India-based IT services provider compromised via an Apple Silicon MacBook; backdoors detected as early as March 18, 2026.
- Malware: FLATROOF (aka Gaslight), a Rust backdoor using Telegram for C2 that steals Chrome, Brave, Firefox, and Safari data, terminal history, and login.keychain-db; ROOFDECK, a backdoor using Nostr for decentralized C2 with remote shell, lateral movement, and Launch Agent persistence.
- Delivery: social engineering job interview lures with GitHub repos containing weaponized .terraform.lock.hcl files pointing to malicious domains like registry.hashicorp-aws[.]com, triggering attacker modules on 'terraform init'.
- An updated ROOFDECK variant deployed April 20, 2026 removes old binaries, symbols, and debug info to evade detection; the same tooling was used in the March-April 2026 KelpDAO LayerZero bridge attack.
- Jade Sleet (PUKCHONG, Slow Pisces, TraderTraitor, UNC4899) previously stole ~$1.5 billion from Bybit via a Safe{Wallet} supply chain compromise.
XMRig miner hidden in Windows Registry, PNG and WAV files in multi-stage attack
Attackers are running an XMRig cryptocurrency miner on Windows systems via a multi-stage chain that hides payloads in the Registry, PNG images, and WAV files.- Affects Windows systems; K7 Security Labs found the chain while investigating repeated PowerShell alerts.
- The miner steals CPU resources for cryptocurrency mining, and a live C2 channel can deliver further malware.
- A PowerShell script reads an encoded stage from Registry key HKLM:\Software\uf42a9660377\vstdfehzr, uses DNS TXT lookups to find a PNG payload, and extracts a hidden script from the PNG's red pixel channel.
- WAV files (Atsg.wav, Tmav.wav, Realtek HD Audio.wav) act as data containers delivering encoded PowerShell and a .NET assembly loaded directly into memory.
- The chain tampers with Defender exclusions and telemetry, persists via scheduled tasks and WMI event subscriptions, drops signed WinRing0.sys, and uses encrypted pool communication over RandomX; IOCs include sslvalidcert[.]com, txtcdn[.]net, and C2 104[.]21[.]2[.]193:8443.
Sources 📄 Source: labs.k7computing.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News