Loading malware…
Jeus is a North Korea-linked malware family associated with GOLDEN CHOLLIMA and the broader AppleJeus activity cluster. First observed in 2018, it was used in campaigns that masqueraded as cryptocurrency-related software published by a fictitious company in order to compromise victims in the cryptocurrency and fintech ecosystem. A macOS counterpart, commonly tracked as AppleJeus, formed part of the same operational lineage. Jeus has been used against targets in the United States, South Korea, Europe, and other economically developed regions with significant digital-asset activity, and has been tied to operations intended to steal cryptocurrency from victim organizations and wallets. The malware is part of a specialized fintech-targeting toolkit within a DPRK cyber apparatus that also shares tooling heritage and infrastructure with other related clusters. High-confidence reporting links Jeus and AppleJeus to trojanized cryptocurrency software used as an initial infection vector and to financially motivated campaigns focused on sustained revenue generation through cryptocurrency theft.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The adversary’s malware originates with Jeus in 2018 (and its macOS variant, AppleJeus), which originally masqueraded as a cryptocurrency application purportedly developed by the fictitious company Celas Limited.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
All three adversaries employ remarkably similar tradecraft — including supply chain compromises, HR-themed social engineering campaigns, trojanized legitimate software, and malicious Node.js and Python packages
The adversary’s malware originates with Jeus in 2018 (and its macOS variant, AppleJeus), which originally masqueraded as a cryptocurrency application purportedly developed by the fictitious company Celas Limited.
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.