North Korean Jade Sleet Compromises Indian IT Provider With Custom Backdoors
North Korean state-sponsored threat actor Jade Sleet has successfully breached an Indian IT services provider, deploying two custom backdoors dubbed FLATROOF and ROOFDECK. This attack continues the group’s established pattern of targeting developers and IT supply chain vendors to pivot into downstream customer networks. Organizations relying on third-party IT providers face elevated risk as Jade Sleet exploits trusted relationships to compromise multiple entities through a single breach. Immediate action includes reviewing IT vendor access controls, hunting for indicators of these backdoors, and implementing enhanced monitoring for supply chain attack vectors.
Introduction
The North Korean advanced persistent threat (APT) group tracked as Jade Sleet has executed another supply chain compromise, this time targeting an unnamed Indian IT services provider. The attack leveraged two previously undocumented backdoors—FLATROOF and ROOFDECK—marking an evolution in the group’s tactical capabilities.
Supply chain attacks continue to represent one of the most effective vectors for state-sponsored threat actors seeking broad access to multiple targets through a single compromise. By infiltrating IT service providers who maintain privileged access to numerous client networks, Jade Sleet positions itself to conduct espionage, intellectual property theft, or cryptocurrency-focused operations across an expanded attack surface.
This incident underscores the persistent threat North Korean APT groups pose to global IT infrastructure, particularly organizations operating within or engaging with the software development and IT services ecosystem.
Background & Context
Jade Sleet, also tracked as TraderTraitor and UNC4899 by various threat intelligence vendors, operates under North Korea’s Reconnaissance General Bureau. The group has established a reputation for sophisticated social engineering campaigns targeting software developers, cryptocurrency industry personnel, and IT professionals.
Historical campaigns attributed to Jade Sleet include Operation Dream Job, which lured targets with fraudulent employment opportunities, and numerous compromises of blockchain and cryptocurrency platforms. The group’s operational objectives align with North Korea’s broader strategic goals: revenue generation through cryptocurrency theft, intellectual property acquisition, and intelligence collection on geopolitical matters.
IT service providers represent particularly attractive targets for APT groups conducting supply chain attacks. These organizations maintain administrative access to client environments, possess sensitive customer data, and often have less stringent security controls than their enterprise clients. A single compromise can cascade into dozens or hundreds of downstream victims.
India’s rapidly expanding IT services sector handles operations for organizations worldwide, making Indian providers strategic targets for nation-state actors seeking broad access. The country’s position as a global technology hub creates numerous opportunities for threat actors to establish footholds with international reach.
Technical Breakdown
FLATROOF Backdoor
FLATROOF functions as a persistence mechanism and initial access backdoor. The malware establishes command-and-control (C2) communications through encrypted channels, allowing operators to maintain long-term access to compromised systems.
Key technical characteristics include:
- Multi-stage deployment using legitimate system processes for evasion
- Encrypted C2 communications using custom protocols
- Credential harvesting capabilities targeting stored passwords and authentication tokens
- Ability to download and execute additional payloads
- Anti-analysis techniques including virtual machine detection
The backdoor’s modular architecture allows operators to customize capabilities based on target environment and operational requirements.
ROOFDECK Backdoor
ROOFDECK serves as a secondary access tool with enhanced capabilities for lateral movement and data exfiltration. Analysis indicates the backdoor was specifically designed for navigating complex enterprise networks.
Technical features include:
- Network reconnaissance functionality mapping connected systems
- File system enumeration and selective data collection
- Support for proxy-aware communications to evade network security controls
- Process injection capabilities for defense evasion
- Remote shell access for interactive operations
The naming convention suggests both backdoors may be part of a broader malware framework developed specifically for this campaign or Jade Sleet’s operational portfolio.
Attack Chain
The initial compromise vector remains under investigation, but evidence suggests potential exploitation of externally facing applications or successful social engineering against provider employees. Once inside the network, Jade Sleet operators deployed FLATROOF to establish persistence, then introduced ROOFDECK for expanded operational capabilities.
The attackers conducted extensive reconnaissance before moving laterally to systems with access to client environments. This methodical approach indicates sophisticated understanding of IT service provider network architectures and data flows.
Impact & Risk Assessment
The immediate impact centers on the compromised Indian IT provider and its clients. Organizations receiving services from the affected vendor face potential unauthorized access to their networks, data theft, and secondary compromise.
Risk Factors
Supply Chain Amplification: A single provider compromise potentially affects dozens or hundreds of downstream organizations across multiple sectors and geographic regions.
Privileged Access Exploitation: IT service providers typically maintain administrative credentials and remote access capabilities, granting attackers elevated privileges in client environments.
Detection Challenges: Malicious activity originating from trusted third-party providers often evades security monitoring configured to permit vendor access.
Long-Term Persistence: APT groups like Jade Sleet prioritize maintaining access over extended periods, creating risk of ongoing espionage or delayed attack execution.
Affected Parties
Organizations most at risk include:
- Current and former clients of the compromised provider
- Software development firms and cryptocurrency companies (Jade Sleet’s typical targets)
- Entities operating in sectors of strategic interest to North Korean intelligence
- Organizations in the broader Indian IT ecosystem potentially targeted in follow-on operations
Vendor Response
The compromised IT service provider has initiated incident response procedures, though public disclosure remains limited. Security researchers who identified the backdoors have shared indicators of compromise (IOCs) and technical analysis with the cybersecurity community.
Threat intelligence vendors tracking Jade Sleet activity have updated their detection signatures and are collaborating with affected organizations. Information sharing through established channels has enabled broader awareness and defensive preparations.
Organizations should contact their Indian IT service providers to confirm whether they’ve been affected and request details on security measures implemented in response to this threat.
Mitigations & Workarounds
Immediate Actions
Credential Rotation: Organizations working with potentially affected providers should immediately rotate all credentials used for third-party access, including service accounts and administrative passwords.
Access Review: Audit all active sessions and remote access connections from IT service providers. Terminate suspicious connections and require re-authentication through validated channels.
Network Segmentation: Implement or reinforce network segmentation limiting third-party provider access to only necessary systems and data.
Technical Controls
Block known IOCs at network perimeter devices:
iptables -A OUTPUT -d [malicious_IP] -j DROP
iptables -A INPUT -s [malicious_IP] -j DROPImplement application whitelisting to prevent unauthorized executable deployment:
# Windows AppLocker policy example
New-AppLockerPolicy -RuleType Publisher,Hash -User Everyone -XmlDeploy endpoint detection and response (EDR) tools with behavioral analysis capabilities to identify backdoor-like activity patterns.
Detection & Monitoring
Indicators to Monitor
Security teams should hunt for:
- Unusual outbound connections to suspicious infrastructure
- Abnormal authentication patterns from service provider accounts
- Unexpected process execution chains involving system utilities
- File modifications in system directories by non-standard processes
- Encrypted traffic to uncommon destinations
Log Analysis
Review authentication logs for anomalies:
# Linux authentication review
grep -i "failed\|failure" /var/log/auth.log | tail -100
ausearch -m USER_LOGIN -sv noWindows security event monitoring:
# Check for unusual logon events
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624,4625} |
Where-Object {$_.Properties[5].Value -like "service_account"}Network Monitoring
Configure intrusion detection systems (IDS) to alert on:
- Encrypted tunneling protocols from unexpected sources
- Data exfiltration patterns (large outbound transfers)
- Connections to geopolitically relevant infrastructure
- Command-and-control communication signatures
Best Practices
Supply Chain Security
Vendor Risk Management: Implement comprehensive third-party risk assessment programs evaluating security postures before granting network access.
Zero Trust Architecture: Adopt zero trust principles requiring continuous authentication and authorization for all access, regardless of source.
Least Privilege Access: Grant vendors minimum necessary permissions and regularly review access requirements.
Contractual Security Requirements: Mandate specific security controls and breach notification timelines in service provider agreements.
Technical Hardening
- Deploy multi-factor authentication for all third-party access points
- Implement privileged access management (PAM) solutions monitoring high-value account usage
- Maintain updated asset inventories identifying systems accessible to external parties
- Conduct regular penetration testing simulating supply chain attack scenarios
- Establish incident response playbooks specifically addressing vendor compromises
Organizational Measures
- Establish security working groups with strategic IT providers
- Require providers to maintain cyber insurance and demonstrate security certifications
- Conduct periodic security audits of high-risk vendor relationships
- Implement threat intelligence sharing arrangements with service providers
Key Takeaways
- North Korean APT group Jade Sleet compromised an Indian IT services provider using custom FLATROOF and ROOFDECK backdoors
- Supply chain attacks amplify attacker impact by enabling access to multiple downstream organizations
- Organizations must immediately review and restrict third-party IT provider access controls
- Technical detection focuses on unusual authentication patterns, unexpected network connections, and behavioral analysis
- Comprehensive vendor risk management and zero trust architectures provide strongest defense against supply chain compromises
- This incident exemplifies ongoing North Korean targeting of IT infrastructure to achieve intelligence and financial objectives
References
- CISA Alert: North Korean State-Sponsored Cyber Actors
- MITRE ATT&CK: Jade Sleet / TraderTraitor Group Profile
- Threat Intelligence Reports on North Korean APT Operations
- Supply Chain Security Best Practices Framework (NIST)
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
