Loading threat actor…
AppleJeus is a North Korean state-linked threat actor associated with the Lazarus ecosystem and focused on financially motivated operations against financial institutions, cryptocurrency businesses, and decentralized finance organizations. Associated tracking names include Citrine Sleet, Gleaming Pisces, UNC1720, UNC4736, Storm-0139, and Storm-1222; vendor-defined activity boundaries overlap rather than necessarily representing identical clusters. The actor uses social engineering, malicious software distribution, software supply-chain compromise, and vulnerability exploitation to gain access. Its activity includes cryptocurrency-themed trojanized applications and the 3CX desktop application supply-chain compromise attributed to UNC4736. In a 2024 decentralized finance intrusion, operators impersonated trading-company employees on Telegram and directed victims to counterfeit meeting-scheduling websites. Citrine Sleet also exploited Chromium vulnerability CVE-2024-7971 in a chain incorporating CVE-2024-38106 to deploy the FudModule rootkit. Post-compromise operations include credential and browser-cookie collection, keylogging, screenshots, host and network reconnaissance, proxy deployment, and remote command execution. Its cross-platform malware ecosystem includes PondRAT, POOLRAT, and ThemeForestRAT, with Windows, Linux, and macOS variants. Windows persistence has involved PerfhLoader, phantom DLL loading through legitimate services, and newly created services. The actor has abused a vulnerable driver associated with CVE-2017-16237 to obtain SYSTEM privileges. Defense-evasion techniques include in-memory payload execution, process injection, encrypted configurations and communications, timestomping, secure artifact deletion, and rootkit deployment. In one extended intrusion, operators replaced earlier implants with RemotePE delivered through a DPAPI-protected loader chain, binding payload recovery to the compromised environment.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
57 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
11 malware families Mallory has associated with this actor across public reporting.
6 additional families tracked in Mallory.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
21 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.