Actor Profile

Jade Sleet (also tracked as PUKCHONG, Slow Pisces, TraderTraitor, UNC4899) is a North Korean state-sponsored threat actor with a history of targeting the Web3 and cryptocurrency sectors for financial gain. The group is attributed to major cryptocurrency heists, including the theft of approximately $1.5 billion from Bybit's cold wallet infrastructure in early 2025 following a supply chain compromise of Safe{Wallet}'s developer environment. While primarily focused on cryptocurrency and blockchain-related organizations, Jade Sleet also targets IT service providers and vendors used by these firms to gain access to downstream networks. The actor's motivation is financially driven, consistent with North Korea's broader cyber operations to generate revenue and evade sanctions.

TTPs (Tactics, Techniques, Procedures)

Jade Sleet employs social engineering via job interview lures targeting developers in DevOps, cryptocurrency, and fintech roles (T1566 - Phishing). The actor creates weaponized GitHub repositories containing malicious Terraform dependency lock files (.terraform.lock.hcl) that point to attacker-controlled domains, triggering malware download when "terraform init" is executed (T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools). The campaign deploys two Rust-based macOS backdoors: FLATROOF (aka Gaslight) uses Telegram for C2 (T1102 - Web Service) and performs command execution (T1059), file operations (T1005 - Data from Local System), and credential harvesting from browsers and keychains (T1555 - Credentials from Password Stores, T1539 - Steal Web Session Cookie). ROOFDECK uses the Nostr protocol for decentralized C2, provides remote shell access (T1059), performs system reconnaissance (T1082 - System Information Discovery), enables lateral movement (T1570 - Lateral Tool Transfer), and establishes persistence via Launch Agents (T1543.001 - Create or Modify System Process: Launch Agent). ROOFDECK commands are cryptographically signed for integrity verification and the malware re-implements common shell commands to evade detection.

Targets & Patterns

Jade Sleet primarily targets individuals and organizations in the cryptocurrency, blockchain (Web3), and financial technology sectors. The actor specifically focuses on developers, DevOps engineers, and technical personnel who possess access to critical infrastructure including cloud environments, CI/CD pipelines, and source code repositories. In this campaign, the group compromised an India-based IT services provider through a DevOps engineer's Apple Silicon MacBook, demonstrating their strategy of targeting third-party vendors and supply chain partners to gain access to downstream clients. The targeting pattern reflects a deliberate focus on developer endpoints as high-value assets that provide privileged access to organizational infrastructure. The use of job interview lures exploits the job-seeking behavior of technical professionals, making this a persistent threat to organizations in the targeted sectors.

Historical Context

Jade Sleet's compromise of the Indian IT provider follows the group's March-April 2026 attack on KelpDAO's LayerZero bridge, which also utilized the FLATROOF and ROOFDECK backdoors. The same GitHub repository (gtn-candidate-repo) was observed in both the KelpDAO incident and subsequent campaigns. An updated version of ROOFDECK was deployed on April 20, 2026—one day after LayerZero publicly disclosed the KelpDAO breach—indicating rapid operational adaptation and OPSEC improvements including symbol stripping and removal of debug information. This campaign continues Jade Sleet's established pattern of supply chain attacks, following their early 2025 compromise of Safe{Wallet}'s developer environment that resulted in the $1.5 billion Bybit theft. The actor's consistent use of developer-focused social engineering and purpose-built development environments demonstrates an evolving but persistent tradecraft targeting the software supply chain.

Defensive Recommendations

  • Monitor execution of 'terraform init' commands and validate Terraform lock file integrity by checking for suspicious registry domains deviating from legitimate hashicorp.com infrastructure (T1195.001)
  • Implement application allowlisting and behavioral monitoring for development tools (e.g., Cursor, VS Code) launching unexpected child processes, particularly Rust-based binaries on macOS systems (T1059)
  • Detect outbound connections to Telegram API endpoints and Nostr protocol relays from developer workstations, especially from non-standard applications (T1102)
  • Monitor for Launch Agent creation and modification in ~/Library/LaunchAgents and /Library/LaunchAgents directories, particularly those referencing unsigned or recently compiled binaries (T1543.001)
  • Implement EDR solutions on developer endpoints with specific focus on credential access patterns including browser data extraction, keychain access, and Terminal history enumeration (T1555, T1539, T1005)
  • Enforce code signing verification for all binaries executed in development environments and alert on execution of stripped or unsigned Rust-compiled executables targeting ARM64 macOS architecture

---

# Geopolitical Context

Geopolitical Context

The compromise of an India-based IT services provider by the North Korean threat actor Jade Sleet represents a continuation of Pyongyang's strategic use of cyber operations to generate revenue and access sensitive networks. Jade Sleet, tracked under multiple aliases including PUKCHONG and UNC4899, has historically focused on cryptocurrency theft to circumvent international sanctions—most notably the $1.5 billion Bybit heist in early 2025. This incident demonstrates the actor's tactical evolution: rather than directly targeting high-value cryptocurrency platforms, Jade Sleet is compromising smaller IT service providers and software supply chains to establish footholds for downstream access to blockchain and financial technology firms. The targeting of a DevOps engineer's macOS endpoint underscores North Korea's recognition that developer environments now serve as critical access vectors to cloud infrastructure, CI/CD pipelines, and proprietary source code. The use of sophisticated, purpose-built malware (FLATROOF and ROOFDECK) with novel C2 mechanisms—Telegram and the decentralized Nostr protocol—reflects operational security adaptations designed to evade detection and complicate attribution.

State Actor Alignment

Jade Sleet is assessed with high confidence to operate on behalf of the Democratic People's Republic of Korea (DPRK). The actor's sustained focus on cryptocurrency theft aligns with North Korea's documented use of cyber operations as a sanctions-evasion mechanism and revenue generation tool for the regime. Multiple cybersecurity vendors and the U.S. government have previously attributed Jade Sleet activity to North Korean state interests. The group's operational patterns—including social engineering via fake job interviews, targeting of Web3 and blockchain sectors, and deployment of custom macOS malware—are consistent with broader DPRK cyber campaign objectives. North Korea remains subject to comprehensive international sanctions, including UN Security Council resolutions and unilateral measures by the United States, European Union, and other jurisdictions. These sanctions explicitly target the regime's weapons programs and illicit revenue generation, including cybercrime proceeds. The compromise of third-party IT providers to access downstream targets represents a strategic effort to obscure attribution and complicate defensive responses while maximizing access to financially lucrative networks.

Business Impacty pro region

The targeting of an Indian IT services provider carries significant implications for the global technology supply chain. India's IT services sector is deeply integrated into international business operations, providing software development, DevOps, cloud management, and technical support to clients worldwide—including in the cryptocurrency, financial technology, and blockchain sectors that Jade Sleet prioritizes. A compromise of such a provider creates potential cascading risks: access to client networks, intellectual property theft, and the possibility of further supply chain compromises. For India, this incident highlights the country's growing exposure as a cyber operations target, not necessarily due to strategic interest in Indian assets per se, but because of its role as a service provider to high-value Western and Asian technology firms. The breach may prompt increased scrutiny of third-party risk management practices among firms relying on Indian IT vendors, particularly those handling sensitive financial or cryptographic operations. For the broader Asia-Pacific region, the incident reinforces concerns about North Korean cyber capabilities and their willingness to target any jurisdiction that provides access to revenue-generating opportunities. European and North American firms with Indian IT service providers in their supply chains face elevated third-party risk and may need to reassess vendor security postures, endpoint monitoring, and access controls for external development teams.

Forecast

If North Korean threat actors continue to refine their targeting of IT service providers and developer environments, organizations across the cryptocurrency, fintech, and blockchain sectors are likely to face increased supply chain compromise risks over the coming months. The use of sophisticated, platform-specific malware for macOS—particularly targeting ARM-based Apple Silicon systems—suggests that defenders should anticipate further tooling evolution as North Korea adapts to the developer ecosystem's hardware and software landscape. If international sanctions pressure on Pyongyang persists or intensifies, DPRK-aligned actors are likely to maintain or escalate financially motivated cyber operations, with Jade Sleet and related groups continuing to prioritize cryptocurrency theft and access to digital asset infrastructure. Organizations that rely on third-party IT vendors, particularly for DevOps, cloud engineering, or software development, should expect heightened scrutiny from regulators and clients regarding endpoint security, supply chain risk management, and monitoring of developer environments. If the pattern of targeting smaller, less-defended IT providers as pivot points continues, the cybersecurity community may see an uptick in incidents where initial compromise vectors are geographically and organizationally distant from the ultimate targets, complicating threat hunting and incident response efforts.