The North Korean state-sponsored group Jade Sleet has been linked to a breach at a small Indian IT services provider. The intrusion relied on two backdoors, FLATROOF and ROOFDECK, to maintain a foothold in the victim's environment.
The targeted company is described as a much smaller organization in the IT services industry. The attack follows a familiar pattern for Jade Sleet, which has repeatedly focused on developers and software supply chains as a way to reach larger, more valuable targets.
The use of these particular backdoors suggests the group is continuing to refine its toolset. While the full extent of the compromise has not been disclosed, the incident underscores the persistent risk facing IT services firms that may serve as stepping stones into other networks.