[jade-sleet]

September 22, 2026

• Jade Sleet (aka TraderTraitor, UNC4899) is tied by SentinelOne to the compromise of a small India-based IT services provider, using macOS backdoors FLATROOF (aka Gaslight) and ROOFDECK — both Rust-based, ARM macOS, and previously seen in the March–April 2026 KelpDAO/LayerZero bridge attack. The lure is a job-interview coding project whose weaponised .terraform.lock.hcl points at registry.hashicorp-aws[.]com, so a developer running terraform init pulls attacker-controlled modules. The Hacker News · Supply Chain & Developer Targeting

in Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance