Jade Sleet Tied to Indian IT Firm Breach Exploiting FLATROOF and ROOFDECK Backdoors

How FLATROOF and ROOFDECK Enabled a Stealthy Supply‑Chain Attack

A North Korean cyber‑espionage group known as Jade Sleet has been linked to the recent compromise of a small Indian information‑technology services company. The intrusion, discovered in early September 2026, involved the insertion of malicious backdoors named FLATROOF and ROOFDECK, which were later used to infiltrate client networks across the region.

Security researchers say the attackers targeted the firm’s development environment, exploiting weak code‑review practices and unsecured build pipelines. By embedding the backdoors into legitimate software updates, Jade Sleet gained persistent access to the victim’s internal systems. The group then leveraged these footholds to move laterally, exfiltrating proprietary data and planting additional malware aimed at larger downstream customers.

The FLATROOF and ROOFDECK tools are custom‑crafted trojans designed to masquerade as routine development utilities. Once installed, they open hidden network sockets that allow remote operators to issue commands without triggering standard intrusion‑detection alerts. Analysts at a leading cyber‑threat intelligence firm noted that the malware’s code shares signatures with previously attributed Jade Sleet campaigns, confirming a direct lineage.

„The attackers were meticulous,” said Ravie Lakshmanan, a senior analyst who tracked the breach. „They injected the backdoors into a rarely used library, knowing it would be pulled into client projects months later, giving them a long‑term espionage window.”

Why Are North Korean Actors Focusing on Smaller IT Vendors?

The compromised Indian firm, described as „much smaller” than typical Jade Sleet targets, served as a stepping stone to reach multinational corporations that rely on its software services. By compromising a supply‑chain node, the group avoided the need to breach heavily fortified corporate perimeters directly.

Jade Sleet’s shift toward modest IT service providers reflects a broader strategic adjustment. Smaller firms often lack robust security budgets and may not enforce strict code‑signing policies, making them attractive entry points. Moreover, these vendors frequently interact with a diverse client base, amplifying the reach of any inserted malware.

Industry observers warn that this tactic could become a preferred method for state‑aligned groups seeking to harvest intellectual property and sensitive data without exposing themselves to high‑profile defenses. „When you compromise a niche developer, you inherit trust relationships with dozens of larger enterprises,” explained a cybersecurity consultant familiar with the case.

The breach underscores the need for rigorous supply‑chain hygiene, including regular code audits, multi‑factor authentication for build servers, and continuous monitoring for anomalous network activity.

Frequently Asked Questions

The fallout from the incident is already rippling through the region’s tech sector. Affected clients are conducting forensic reviews, and several have issued public statements reassuring stakeholders that no critical data appears to have been exfiltrated. Nonetheless, the episode highlights the persistent threat posed by sophisticated state‑backed actors and the importance of hardening even the smallest links in the software supply chain.

What is Jade Sleet? Jade Sleet is a moniker for a North Korean cyber‑espionage group linked to multiple high‑profile intrusions. It specializes in supply‑chain attacks using custom backdoors.

How did the FLATROOF and ROOFDECK backdoors work? Both tools embed themselves in legitimate software updates, creating hidden communication channels that let attackers control infected systems remotely while evading detection.

What steps can companies take to prevent similar attacks? Implement strict code‑review processes, enforce multi‑factor authentication on development tools, and deploy continuous monitoring to detect unusual network traffic.