Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

thehackernews.com Sep 21, 2026

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

Curated by Shubham · TechCapsules · Sep 21, 2026

AI-summarised brief · reviewed before publication

SentinelOne revealed that North Korean threat actor Jade Sleet targeted an India‑based IT services firm, deploying Apple macOS backdoors FLATROOF and ROOFDECK. The attack used social‑engineering job‑interview lures to compromise a DevOps engineer’s Apple Silicon MacBook, with the backdoors first detected on March 18, 2026. The implants remained dormant until March 29, then began beaconing, and a newer ROOFDECK variant appeared on April 20, 2026, stripping debug symbols to evade detection. The campaign underscores Jade Sleet’s focus on cryptocurrency and blockchain vendors.

💡 Why It Matters

· The breach demonstrates how supply‑chain attacks now hinge on developer endpoints, turning individual engineers into high‑value targets that can unlock entire cloud pipelines.
· This shift forces organizations to rethink security beyond perimeter defenses, prioritizing continuous monitoring of development environments.

Capsules Cybersecurity

Read full article on thehackernews.com

SEALSQ, WISeKey and Jura Sign MoU for Swiss Post-Quantum Semiconductor Center

SEALSQ Corp, WISeKey International Holding, and the Canton of Jura signed a memorandum of understanding to create a Post‑Quantum Semiconductor and Cybersecurity Center in the Swiss canton. The project will invest roughly CHF 40‑60 million over six years, focusing on the QS7001 Quantum Shield and related secure firmware personalization, testing, and certification. The initiative aims to generate about 40 jobs in two years, expanding to over 250 by year eight, with a majority of positions filled by local residents. The center will build on the Quantix Edge Security model in Spain and seek partnerships with Swiss academia, industry, and defense programs.

💡 By establishing a sovereign post‑quantum semiconductor hub, Switzerland could secure critical supply chains for defense and high‑security sectors, reducing reliance on foreign technology. The collaboration leverages local precision manufacturing expertise, positioning the country as a leader in quantum‑ready hardware.

thehackernews.com · Sep 21

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Threat actors are using ClickFix‑style lures to deliver a new remote‑access trojan dubbed ChainScript. The malware, also seen under names such as ComponentTask33 and OrchidViolet66, masquerades as legitimate software like Spotify, Zoom Workplace and Microsoft Teams. After a malicious MSI installer runs via msiexec.exe, it drops a Node.js runtime and launches a JavaScript agent through hidden PowerShell and VBScript stages, installing components in “%LOCALAPPDATA%” and persisting via a scheduled task with a Registry Run key fallback. ChainScript employs an EtherHiding‑style C2 discovery method that queries a Polygon smart contract to locate its WebSocket server, allowing the backend to rotate without changing the implant. The RAT offers full remote control, including CMD/PowerShell shells, file manipulation, screenshot capture, cryptocurrency wallet enumeration and remote JavaScript execution. The campaign, linked to the compromised HBO Max Reddit account, also distributes macOS stealers and crypto clippers, with 108 malicious ads posted over 48 hours in mid‑September 2026.

💡 By offloading C2 resolution to a blockchain contract, attackers can instantly shift infrastructure, rendering traditional takedown and signature‑based defenses ineffective. This technique signals a new frontier where decentralized platforms become core components of malware command structures.

infosecurity-magazine.com · Sep 21

Revolut Customers Targeted with New Wave of Phishing Attacks

Hackers have exploited a recent Revolut data breach to launch a smishing campaign targeting the fintech firm’s customers, Malwarebytes reported. The phishing texts, first seen on September 14, mimicked legitimate Revolut messages and urged recipients to click a link to “confirm their identity” or face account restrictions. The link directed users to a counterfeit live‑video verification page that requested camera access, then prompted for passwords, allowing attackers to capture selfies or videos for further fraud. Malwarebytes warned that if the campaign is tied to the breach, criminals could obtain enough personal data to hijack accounts. The breach appears to have focused on Revolut’s Lithuanian‑regulated entity, with threat actors impersonating Italian law enforcement to submit fraudulent KYC requests, affecting several hundred accounts, notably high‑net‑worth crypto users.

💡 The fake video‑verification trick turns a routine security step into a weapon, giving scammers biometric data that can bypass traditional authentication methods.

cyberint.com · Sep 20

MovieReaper Malware: From Movie Download to Malware Infection

MovieReaper, first seen in September 2026, is a modular malware that blends a remote‑access trojan with a loader, targeting x86‑64 Windows systems. It spreads via compromised torrent‑file infrastructure, delivering a disguised loader that passes anti‑sandbox checks, downloads shellcode, and retrieves command‑and‑control endpoints from a Solana blockchain. Subsequent stages establish HTTPS communication with certificate pinning, load additional COFF modules, perform UAC bypass, and persist by masquerading as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe. The final implant offers full file‑management, exfiltration, and remote control, enabling durable, stealthy post‑compromise activity across individuals and organizations worldwide.

💡 The use of blockchain‑based C2 and torrent‑file delivery expands the attack surface beyond traditional phishing, enabling attackers to reach a global user base with minimal effort. This strategy demonstrates how malware can exploit legitimate infrastructure to evade detection and maintain persistent, high‑impact access.

thehindu.com · Sep 20

CID trains officers in cybercrime investigation, digital forensics

The Crime Investigation Department (CID) of Andhra Pradesh concluded a three‑day training programme on cyber security and cyber hygiene for its investigation officers on Saturday at the headquarters in Vijayawada. Directed by CID Director General of Police Ravi Shankar Ayyanar, the course aimed to boost police capability in probing cyber offences and to instill practices in safety. Cyber‑security expert Sandeep Madulkar, CEO of Sytech Labs, served as the resource person, delivering modules on emerging threats, digital arrest scams, evidence collection, social‑media crime, financial fraud, web intelligence, IP tracing, malware analysis and forensic tools. Sessions covered dark‑web investigations, anonymity tactics, blockchain and cryptocurrency probes. Participants included CID superintendents and officers from state wings, such as R. Gangadhar and P. Parameshwar Reddy.

💡 Equipping officers with advanced digital forensics tools directly strengthens law‑enforcement’s ability to disrupt sophisticated cyber fraud networks in the region.

thehackernews.com · Sep 20

CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Red Hat issued advisories on September 19, 2026, urging high‑priority fixes and noting public exploits. Federal agencies are directed to patch by September 21 under BOD 26‑04. The flaws—CVE‑2026‑80844, CVE‑2026‑81000, CVE‑2026‑68121, and CVE‑2026‑74469—were disclosed by researcher Asim Manizada and involve local privilege escalation. The incidents underscore the growing threat of AI‑driven attacks on enterprise systems.

💡 The rapid patching mandate signals a shift toward stricter federal security compliance, forcing agencies to prioritize kernel updates. It also highlights how AI tools are accelerating exploitation, demanding tighter runtime identity controls.