Jade Sleet, the North Korean group tracked separately from the Contagious Interview crew now blamed for 30,000 device compromises and $10.7 million in stolen crypto across more than 100 countries, breached what researchers describe only as "a much smaller organization" in India's IT services sector. The tool set was not new. Jade Sleet's calling card since its GitHub-supply-chain campaigns against cryptocurrency developers has been social engineering into a foothold, then backdoors that get incremental updates rather than full rebuilds between operations. Reuse is a resourcing decision, not a technical limitation. A group backed by a state does not need novelty when the defender side keeps failing to update its detection signatures to match tooling that has already been public for years.

The exposure here is not the smaller firm itself. It is the IT services sector's position as a pass-through: a compromised services provider in India sits upstream of whatever clients it touches, and Jade Sleet has run this exact play before against software supply chains to reach downstream targets with better security budgets than the provider itself. The Hacker News reporting does not name the downstream clients, and nothing in the current disclosure confirms lateral movement occurred. What the pairing with Contagious Interview's 30,000-device tally does confirm is scale of intent: North Korean operators are running parallel campaigns against IT services and crypto-adjacent job seekers simultaneously, not sequentially, which means detection built for one campaign's signatures will not catch the other.

Separately, CISA logged three actively exploited Linux kernel flaws this week, one rated critical, a reminder that state-linked groups exploiting old backdoors and criminal groups exploiting new kernel bugs draw from the same pool of unpatched infrastructure. Neither Jade Sleet's backdoors nor the kernel flaws are exotic. Both were catalogued before they were used against the targets now dealing with the aftermath.