North Korean Group Jade Sleet Tied to Indian IT Firm Breach via FLATROOF and ROOFDECK Malware

Cybersecurity analysts have linked the North Korean threat actor known as Jade Sleet to a recent intrusion of a small Indian information technology services firm, marking another instance in which the group exploits software developers to gain footholds in larger target networks.

The breach was discovered after security teams identified two malicious components, codenamed FLATROOF and ROOFDECK, embedded in the compromised organization’s development environment. Both tools function as backdoors, allowing remote command and control while remaining difficult to detect amid legitimate code repositories.

Jade Sleet’s tactics align with a broader pattern observed among state‑aligned actors from the Democratic People’s Republic of Korea, who often infiltrate smaller supply‑chain partners to reach more lucrative downstream victims. By compromising a developer’s workstation or build system, the attackers can insert malicious code that later propagates to the software products of larger enterprises, potentially exposing sensitive data or enabling espionage.

The Indian firm, described in intelligence reports as “much smaller” compared to the multinational clients it supports, did not disclose the scope of the intrusion. However, experts warn that the presence of FLATROOF and ROOFDECK suggests the attackers intended to maintain long‑term access, possibly to harvest credentials, exfiltrate proprietary source code, or pivot to client networks.

Industry observers note that India’s burgeoning IT services sector has increasingly become a focal point for foreign cyber operations. The country’s large pool of developers, combined with its role as a global outsourcing hub, makes it an attractive target for groups seeking to embed malicious components at the source level. The Jade Sleet incident underscores the need for robust development‑stage security controls, such as code‑signing, strict access management, and continuous monitoring of build pipelines.

While no public attribution has been made against specific victim organizations beyond the Indian provider, the incident serves as a reminder that supply‑chain threats remain a persistent challenge. Authorities and private security firms are expected to issue advisories urging firms to audit their development environments, implement zero‑trust principles, and share threat intelligence to mitigate the risk of similar compromises in the future.