Loading story…
U.S. agencies and security researchers linked North Korea’s Lazarus Group—also tracked as APT38, BlueNoroff, Stardust Chollima, and HIDDEN COBRA—to a long-running campaign targeting cryptocurrency exchanges, DeFi platforms, trading firms, venture capital funds, gaming companies, and high-value holders. The operation used spearphishing, fake job offers, fraudulent trading firms, social networking, and even fake Telegram groups to lure victims into downloading trojanized cryptocurrency trading and wallet applications on Windows and macOS, with activity reported across more than 30 countries. Researchers described later activity as an evolution of the earlier AppleJeus campaign, while U.S. agencies said the broader effort continued under the TraderTraitor cluster.
The malicious apps—including Celas Trade Pro, JMT Trading, Union Crypto, Kupay Wallet, CoinGoTrade, Dorusio, Ants2Whale, DAFOM, TokenAIS, CryptAIS, AlticGO, Esilet, and CreAI Deck—appeared legitimate but installed hidden updater components, persistence mechanisms, and remote-access payloads such as Manuscrypt variants. Analysis of Union Crypto showed the malware collecting host details, installing services or LaunchDaemons, contacting command-and-control infrastructure, downloading second-stage payloads, and enabling file operations, screenshots, command execution, lateral movement, theft of private keys, and fraudulent blockchain transactions. U.S. authorities said the campaign supports North Korea’s sanctions evasion and revenue generation, and warned that cryptocurrency and blockchain firms remain likely targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The FBI, CISA, and the U.S. Treasury issued a joint advisory on TraderTraitor, attributing the campaign to North Korean state-sponsored actors tracked as Lazarus Group, APT38, BlueNoroff, and Stardust Chollima. The advisory detailed fake job-offer lures, trojanized apps such as DAFOM and TokenAIS, associated indicators of compromise, and recommended mitigations.
The FBI, CISA, and the U.S. Treasury issued a joint advisory attributing the AppleJeus malware campaign to North Korea's Lazarus Group/HIDDEN COBRA and warning that trojanized cryptocurrency applications had targeted victims in more than 30 countries.
The FBI, CISA, and the U.S. Treasury released malware analysis reports covering multiple AppleJeus variants, including Celas Trade Pro, JMT Trading, Union Crypto, Dorusio, and Ants2Whale, documenting technical behaviors and infrastructure used to steal cryptocurrency.
ESET disclosed that Lazarus-linked AppleJeus activity included a rebranded macOS cryptocurrency trading application bundled with malware. The report added technical detail on how trojanized trading software was being adapted and repackaged to target cryptocurrency users on macOS.
Kaspersky reported that Lazarus had evolved its cryptocurrency theft activity through 2019 into 'Operation AppleJeus Sequel,' using fake trading firms, fraudulent websites, and Telegram groups to trick victims into downloading malware. Confirmed victims included cryptocurrency businesses in the UK, Poland, Russia, and China.
A version of the AppleJeus malware family using the trojanized Union Crypto trading application was discovered in December 2019, with hidden updater components enabling persistence, host profiling, and second-stage payload delivery on Windows and macOS.
The AppleJeus malware campaign, attributed to North Korea's Lazarus Group, was first uncovered in 2018 using trojanized cryptocurrency trading and wallet applications to steal cryptocurrency from victims.
U.S. agencies later assessed that North Korean state-sponsored actors began targeting cryptocurrency and blockchain organizations with the TraderTraitor campaign by at least 2020, using spearphishing and fake job offers tied to trojanized trading and portfolio applications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourceus-cert.gov
Open sourcecisa.gov
Open sourceus-cert.gov
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked **Velvet Chollima**—also tracked as **Kimsuky**, **APT43**, and Microsoft’s **Ruby Sleet**—ran a financially motivated campaign that used a trojanized cryptocurrency trading application named **Tralert FX** to compromise retail crypto traders. The operation reportedly began in June 2025 and relied on an **EV-signed installer** associated with **"AgilusTech LLC"** to make the lure appear legitimate, then deployed a multi-stage malware chain designed to harvest browser credentials and cryptocurrency wallet data from infected Windows systems. The intrusion chain established persistence through **Windows scheduled tasks** and ultimately delivered **MoonPeak**, a customized **.NET XenoRAT** variant. Operators used **GitLab** for both command-and-control and data exfiltration, with infected hosts polling roughly every 30 minutes. Reporting tied the campaign to more than **4,100 operator commits** and over **90 compromised hosts** at disclosure, indicating a sustained, scalable DPRK monetization effort focused on high-volume theft from individual cryptocurrency users rather than the exchange-focused intrusions more commonly associated with Lazarus.
Jun 29, 2026
North Korean state-sponsored threat actors, including the Lazarus Group and Kimsuky, have been responsible for a dramatic surge in global cryptocurrency theft in 2025, stealing at least $2.02 billion—over half of the total $3.4 billion stolen worldwide. The February compromise of the Bybit cryptocurrency exchange accounted for $1.5 billion of these losses, with the attack attributed to the TraderTraitor cluster, and further links established through malware infrastructure analysis. Lazarus Group, affiliated with North Korea's Reconnaissance General Bureau, has also been implicated in the theft of $36 million from Upbit and is estimated to have stolen over $6.75 billion cumulatively through a series of high-profile heists and campaigns. Recent collaborative research by Hunt.io and the Acronis Threat Research Unit has uncovered new operational infrastructure used by both Lazarus and Kimsuky across global campaigns. The investigation revealed active tool-staging servers, credential theft environments, and tunneling nodes, highlighting the interconnected nature of DPRK cyber operations. Despite evolving malware and tactics, these groups consistently reuse infrastructure, making their activities traceable across campaigns. The findings provide defenders with actionable intelligence on the infrastructure patterns and operational habits of North Korean threat actors, supporting efforts to detect and disrupt ongoing and future attacks.
Jun 29, 2026
Expel reported that a North Korean state-sponsored threat group linked to **Lazarus** is targeting **Web3 developers** in a campaign designed to steal **cryptocurrency** and **non-fungible tokens (NFTs)**. The activity focuses on developers working in blockchain and related ecosystems, a sector that remains attractive to DPRK operators because of its direct access to digital assets and development environments. The reporting describes the operation as part of a broader effort to industrialize social engineering and intrusion activity with **AI-assisted tactics**, allowing the group to scale outreach and improve the credibility of its lures. The campaign underscores Lazarus's continued focus on financially motivated operations that blend state-backed tradecraft with theft of digital assets from individuals and organizations tied to the Web3 sector.
Jun 29, 2026