source_4021.pdf (2 MB)

Jade Sleet compromised a DevOps engineer at an India-based IT services provider through a fake interview repository whose Terraform lockfile redirected `terraform init` to typosquatted provider registries. FLATROOF and ROOFDECK remained dormant for eleven days before a Cursor workspace launched them as child processes on macOS. FLATROOF stole credentials and system data through Telegram, while ROOFDECK used Nostr relay dead drops, signed operator commands, and Launch Agent persistence for second-stage access. CSA links the activity to the financially motivated North Korean cluster also tracked as TraderTraitor and UNC4899.