Jade Sleet Breaches Indian IT Provider with FLATROOF and ROOFDECK Backdoors

Jade Sleet Exploits Indian IT Firm via FLATROOF and ROOFDECK Backdoors

SentinelOne’s latest report confirms that the North Korean threat actor Jade Sleet breached a modest Indian IT services company, using the FLATROOF and ROOFDECK malware families to slip past development environments. The intrusion highlights a growing pattern of targeting software supply chains, a tactic first observed during the pandemic era when remote code signing surged.

Technical footprint of the backdoors

The FLATROOF module installs a persistent root certificate, while ROOFDECK opens a covert channel to command‑and‑control servers. Analysts noted a ↓ 30% drop in detection rates after the malware mutates its payload.

“We see an alarming acceleration in supply‑chain compromises,” said a SentinelOne spokesperson, referencing similar activity reported by Reuters.

Experts warn that the compromised firm, though small, services larger enterprises, potentially extending the breach’s reach. Organizations are urged to audit third‑party code and enforce strict code‑signing policies.