Loading story…
Researchers attributed the RustBucket malware campaign to Bluenoroff, a North Korea-linked intrusion set tied to financially motivated operations, and reported that the group expanded the malware to target macOS alongside a Windows .NET variant. The infection chain used a fake PDF reader and a specially crafted PDF document to trigger malicious behavior, collect host information, and retrieve additional payloads from command-and-control infrastructure via HTTP POST requests.
The campaign was linked to broader SnatchCrypto activity targeting cryptocurrency, fintech, venture capital, and other finance-related organizations across Asia, the United States, Europe, and the UAE. Investigators also connected the operation to phishing lures, typosquatting domains, and multiple delivery formats including LNK, MSI, OneNote, VHD, CAB, and CHM files, while the Windows variant was observed checking for antivirus products and using alternate execution paths such as rundll32 or explorer.exe injection to load later stages.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
In April 2023, Jamf published a report on RustBucket as a newly observed macOS malware family and linked the activity to Bluenoroff.
In March 2023, Sekoia.io observed MSI and OneNote files containing commands similar to previously reported VHD-based Bluenoroff activity, used to drop downloader sample 529c65521e8a07c8810b6d225f7e2a89.
Since at least December 2022, Bluenoroff has leveraged RustBucket, a malware family written in Rust and Objective-C, to target macOS systems. Sekoia.io assessed this as the first observed case of Bluenoroff targeting macOS users.
Since 2017, Bluenoroff has conducted financially motivated campaigns targeting cryptocurrency exchanges and venture capital-related entities in Europe, Asia, the United States, and the UAE. Sekoia.io assessed the newly observed activity as part of this broader SnatchCrypto campaign.
Bluenoroff, a North Korea-nexus intrusion set allegedly subordinated to RGB Bureau 121, has been tasked with revenue generation since at least 2015.
Researchers analyzed a new BlueNoroff-linked macOS loader variant, 'EdoneViewer,' delivered in a ZIP archive with a decoy PDF and using a valid Apple developer signature that was later revoked. The malware decrypted an AppleScript that fetched a second-stage Trojan from on-global[.]xyz, expanding known RustBucket-related tradecraft against crypto-focused targets.
Sekoia.io further investigated RustBucket infrastructure and attributed the activity to Bluenoroff with high confidence. The report also identified a Windows .NET variant and broader infrastructure tied to phishing lures, typosquatting domains, and multiple delivery formats.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 76 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs identified a new macOS variant of **RUSTBUCKET** in the REF9135 campaign targeting a U.S.-headquartered cryptocurrency payment-services provider. Elastic attributed the activity with high confidence to DPRK-linked Lazarus Group/BlueNorOff operations, citing overlaps in malware, victimology, and command-and-control infrastructure. The malware uses Swift and Rust stages, supports both Intel and ARM-based Macs, and establishes persistence through a macOS LaunchAgent. The operators used restrictive, nonstandard User-Agent validation to limit payload delivery and rapidly rotated command-and-control infrastructure to frustrate analysis and detection; no VirusTotal engines detected the variant when Elastic reported it.
Sep 9, 2026
North Korean-linked threat actor **BlueNoroff** has been observed targeting **macOS** users through lures tied to fake cryptocurrency news, extending the group’s financially motivated intrusion activity into Apple environments. The campaign used social engineering themes designed to appeal to crypto-focused victims, indicating continued interest in organizations and individuals involved in digital assets and related financial operations. Researchers reported that the operation also introduced **novel persistence** techniques on Macs, suggesting a more mature toolset for maintaining access after initial compromise. The activity highlights a growing risk to enterprises that rely on macOS endpoints in finance and cryptocurrency-adjacent workflows, where trusted news themes and investment-related content can be used to deliver malware and support long-term unauthorized access.
Jun 29, 2026
North Korean threat actor BlueNoroff, a sub-cluster of the Lazarus Group, has launched two sophisticated campaigns—GhostCall and GhostHire—targeting executives in the fintech, venture capital, and Web3 development sectors. According to Kaspersky and corroborated by multiple sources, GhostCall leverages social engineering via platforms like Telegram to lure technology and venture capital executives into fake investment meetings, ultimately tricking them into downloading malicious scripts disguised as Zoom updates. These scripts deploy infection chains on macOS devices, resulting in credential theft and system compromise. GhostHire, meanwhile, targets Web3 developers by inviting them to complete skill assessments through booby-trapped GitHub repositories, which deliver tailored malware payloads based on the victim's operating system. Both campaigns demonstrate BlueNoroff's evolving tactics, including the use of generative AI for malware development and a shift from macOS to Windows platforms. Researchers note that these operations are part of BlueNoroff's broader, years-long SnatchCrypto campaign, which aims to steal cryptocurrency and financial data to fund the North Korean regime. The campaigns employ advanced social engineering, cross-platform malware, and innovative infection vectors, highlighting the group's increasing sophistication and adaptability. The targeting of high-value individuals in the fintech and Web3 sectors underscores the persistent threat posed by North Korean APTs to the global cryptocurrency ecosystem, with significant financial and reputational risks for affected organizations and individuals.
Jun 29, 2026