Jade Sleet's macOS backdoors showed up on an IT-services MacBook. The crypto heist was optional.

SentinelOne hunted FLATROOF and ROOFDECK after LayerZero and found a DevOps engineer in India. Delivery on this host is unproven. Hunt Cursor children and HashiCorp typosquats.

RWP Ventures · 2026-09-21 · event 2026-09-18 · 11 min read · priority 8.4

The actor cluster is SentinelOne’s: TraderTraitor, also tracked as Jade Sleet, UNC4899, PUKCHONG, described as a financially motivated DPRK-aligned Lazarus subgroup. RWP is not independently attributing. Google and Mandiant are credited as partners on the toolset. The same families were used in the March–April 2026 LayerZero / KelpDAO intrusion.

Do not collapse three facts.

1. This victim is not LayerZero. SentinelOne found it by hunting the implants, not by walking a crypto incident.
2. Initial access on this MacBook is UNKNOWN. Hashes were on disk by 18 March 2026. First observed execution was 29 March, parented by Cursor. SentinelOne cannot prove the delivery path on this host.
3. The campaign method, elsewhere, is a fake job interview that ships a weaponized .terraform.lock.hcl. terraform init then pulls a provider from a typosquat of HashiCorp’s registry. That is CONFIRMED as the LayerZero path and as the lure set SentinelOne recovered. It is not proven for the Indian host.

CISA KEV catalog 2026.09.18 (count 1716, still the live feed this morning) has no row for these implants. There is nothing to wait for.

This is not a re-run of [yesterday’s Conductor GraalVM RCE](/posts/2026-09-20-conductor-cve-2026-58138-graalvm-rce/). Different product, different clock, different class of access.

What happened

SentinelOne’s hunt started from the LayerZero disclosure. After that public report, the lab looked in its own telemetry for the same ARM64 Rust backdoors and found one more host. Authors: Albert Priego, Alex Delamotte, Matej Havranek. The write-up is paired with a LABScon 2026 talk, Don’t Call Us, We’ll Call Your APIs.

The engineer ran Terraform and Ansible against AWS, OVH, and OpenStack on working days. The laptop held cloud credentials and source-control access. SentinelOne’s comparison is LayerZero’s “Developer1”: the value of the target is whatever the laptop can reach.

Timeline, as published — SentinelOne telemetry, not a reconstructed campaign diary:

The 13 April clone is not the origin story on this host. The implants were already executing two weeks earlier. Treat the Terraform lure as campaign tradecraft, not as the proven vector for this MacBook.

Campaign lure set, recovered from GitHub:

• Repos: gtn-candidate-repo (LayerZero), Northwind-IAC, novacart-interview, terraform-candidate-repo
• Typosquat provider domains: registry.hashicorp-aws[.]com, registry.hashicorp-aws[.]io, registry.hashicorp-terraform[.]io
• Mechanism: a weaponized .terraform.lock.hcl that makes Terraform treat the attacker registry as the source of truth

One candidate left a note that they had removed a typosquatted provider. Awareness works. It is not a control.

Why it matters

The interesting fact is not that DPRK operators steal cryptocurrency. It is that the same implants and the same interview packaging landed on an IT-services DevOps endpoint that had no Web3 business.

A developer laptop is a control plane. Terraform, Ansible, AWS, OVH, OpenStack, and source control are how that engineer’s employer — and that employer’s customers — get built. SentinelOne’s conclusion, which we will not inflate: not every foothold becomes a $292 million mint event. The LayerZero / KelpDAO theft remains the high-value case. This one, they assess, was not worth keeping.

That is not comfort. It is a hunting problem. The dwell on this host ran from mid-March into June. Beaconing was gated on an IDE. Persistence looked like Apple: SystemUpdate under com.apple.iTunesCloud, iSync under com.apple.internal.ck, later loginwindow under com.apple.appleaccountd, LaunchAgent with --type=renderer.

ROOFDECK’s C2 discovery uses Nostr relays and an operator profile’s website field as a dead-drop, with Pastebin-style fallback and a pinned TLS certificate minted by mkcert on a QEMU box as user ub. FLATROOF exfiltrates over Telegram. Indicator-based blocking of a single domain does not close that channel.

Do not write an OT event. SentinelOne did not identify industrial-control, SCADA, or physical-process impact. An IT-services firm may have industrial customers. That is UNKNOWN. Inventory whether DevOps laptops can reach those customers. Do not invent a plant incident.

Who / what is affected

Technical context

Both implants are ARM64, Rust, built for macOS.

FLATROOF (~/Library/com.apple.iTunesCloud/SystemUpdate, SHA-1 02df07a173ab03b82a4fb6a08973fff8b1467f28): first-stage collection and loader. Commands include shell, upload (Telegram attach), kill, id, stop. A bundled Python harvester takes Chrome, Brave, Firefox, and Safari data, shell history, system_profiler, ps aux, installed apps, and a raw login.keychain-db. On start it strips quarantine from ROOFDECK.

ROOFDECK (~/Library/com.apple.internal.ck/iSync, SHA-1 c491d477dbe0ae04e9aed9dbe237144c03f73ec4; later ~/Library/com.apple.appleaccountd/loginwindow, SHA-1 5728b11d30586bbfc1d8bd12df1c722a06e767a2): second-stage. Config at ~/.config/.repl_history. First-run C2 comes from Nostr profile lookup (api.nostr[.]watch/v1/online plus a hardcoded relay list: relay.damus[.]io, nos[.]lol, nostr[.]mom, relay.snort[.]social, and others). Commands are RSA-signed. The implant reimplements file and directory operations rather than calling the obvious shell — a pattern SentinelOne maps to Lazarus LightlessCan. Persistence: ~/Library/LaunchAgents/ plist, RunAtLoad, --type=renderer. HTTPS tasking path /app_version. IPC pipe /private/tmp/.pipe-airway.

mkcert artifact (hunt this, do not treat as unique to one domain):

• Subject/Issuer: O=mkcert development CA, OU=ub@ub-Standard-PC-Q35-ICH9-2009, CN=mkcert ub@ub-Standard-PC-Q35-ICH9-2009
• Serial 1cd6d13ff15adbf7a42025d10ec99b4a
• SHA-256 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa
• Validity 2025-06-20 → 2035-06-20

ATT&CK mapping (defensive, from observed behavior — not a complete actor playbook): T1566.002 (interview / coding-challenge lure), T1195.002 (malicious Terraform provider), T1059.004 / T1059.006 (shell, Python harvester), T1553.001 (quarantine attribute), T1543.001 (Launch Agent), T1036 (Apple-looking names, --type=renderer), T1555.001 / T1555.003 (keychain, browsers), T1102 (Telegram, Nostr dead-drop), T1071.001 (HTTPS /app_version), T1070.004 (implant deletion on 20 April).

Threat / exploitation status

X discussion of the SentinelOne paper (18–21 September) is amplification, not measurement. RWP used it as discovery only.

What defenders should do

Today, on macOS developer endpoints — especially anyone with cloud or VCS admin:

1. Hunt the paths and hashes above. Unsigned or ad-hoc-signed Mach-O in $HOME/Library/com.apple.* that is not an Apple-shipped binary is the ticket, not the C2 domain of the week.
2. Hunt LaunchAgents whose ProgramArguments include --type=renderer and a binary that is not Chromium/Electron.
3. Hunt IDE telemetry: Cursor, VS Code, JetBrains spawning nohup children under those Library paths. On this host the implants only beaconed while Cursor was running.
4. Hunt ~/.config/.repl_history as a ROOFDECK config, /private/tmp/.pipe-airway, and $TMPDIR/tmp*.lock.
5. Pull TLS inspection or certificate inventory for the mkcert ub@ub-Standard-PC-Q35-ICH9-2009 subject. SentinelOne listed related names including grenight[.]com, storage.hubpage[.]cloud, technicais.sytes[.]net, mactroubleshoots[.]pro, heyhay[.]online, galaxy-royal[.]online.
6. Inventory .terraform.lock.hcl across developer home directories and CI. Flag any provider source host that is not registry.terraform.io. The three typosquats above are sufficient to start; they are not a complete list.
7. Ask engineers — in a non-punitive channel — whether they ran an external take-home or “interview task” repo on a corporate Mac in 2026. Telemetry will not label a recruiter.
8. If you find the implants: treat cloud keys, VCS PATs, browser sessions, and the login keychain as burned. Rotate. Do not call the ticket closed on a binary delete; S1 watched the operator delete the first stage themselves on 20 April and keep a stripped successor.

Policy that actually changes the intercept:

• Corporate workstations are not for external coding interviews. If you cannot enforce it, you do not have it.
• Train DevOps on lockfile registries the same way you train them on curl | sh. One candidate already caught the HashiCorp typosquat. That is the cheap control.

Do not publish or replay exploit steps for the Terraform provider, the Nostr dead-drop, or the implants. The hashes, paths, and registry hostnames are enough to hunt.

RWP assessment

Score 8.4. High confidence on the host facts. Moderate confidence on the cluster name. Low confidence that this is a new mass IT-services campaign.

Why this outranked the rest of the window: it is the first Daily Top on this victim expansion; the access class is developer-to-cloud, which is how enterprises actually get run; the primary source is a lab paper with timestamps, hashes, and a honest UNKNOWN on delivery. CISA did not add a KEV row over the weekend — catalog still 2026.09.18 — so there is no federal clock hiding the story.

Runner-up, not selected: Checkmarx’s indexed-btree npm campaign (17 September, BleepingComputer 20 September) is a real supply-chain shift — malware in BTree.prototype.set() instead of install scripts, Checkmarx’s “almost 2 million weekly downloads” claim, packages subsequently pulled. It loses on attribution quality and on “what a CISO does Monday morning” versus a named DPRK toolset on a DevOps Mac. CVE-2026-90817 in REDCap (CNA published 20 September, CVSS 9.8, patch floors 16.0.49 / 17.3.10 / 17.4.4) is unauthenticated RCE through survey passthrough plus data-import, but the CNA requires a valid public survey hash and does not claim exploitation. Vanderbilt / REDCap is a clinical-research surface; we already covered UNC6508’s REDCap espionage as a June backfill. No KEV row. CVE-2026-90822 / 90823 in FatPipe MPVPN (Securifera, 21 September) are unauthenticated root on an EOL image, management interface disabled by default. No in-wild claim. Blackpoint’s ChainScript RAT (21 September) is a new ClickFix / EtherHiding family. Cybercrime, Windows, Polygon resolver — crowded pattern, weaker enterprise control-plane.

We are not scoring “DPRK plus Mac” as automatically 9. The last beacon in the paper is June. The decision this morning is hunt-and-policy, not emergency patching of a KEV appliance.

What we are watching

• A second independent lab or national CERT matching FLATROOF / ROOFDECK on non-crypto victims.
• Whether CISA, or a vendor PSIRT, ever files a KEV-class row. Unlikely for a custom implant; still check the feed.
• Terraform official-registry abuse, which S1 already warns is possible even when the hostname is correct.
• Collapse risk: WaterPlum (job-seeker malware, law-enforcement advisory last week) is a different DPRK cluster. Do not merge the names.
• REDCap CVE-2026-90817 moving from advisory to exploitation. Survey-hash prerequisite keeps it off today’s lead. It does not make internet-facing REDCap safe.

Sources

Primary: SentinelOne, 18 September 2026. Secondary amplification: The Hacker News, 21 September 2026. KEV negative: CISA catalog 2026.09.18. Runner-up primaries as linked in the header. X used as discovery only.