Loading story…
Elastic Security Labs identified a new macOS variant of RUSTBUCKET in the REF9135 campaign targeting a U.S.-headquartered cryptocurrency payment-services provider. Elastic attributed the activity with high confidence to DPRK-linked Lazarus Group/BlueNorOff operations, citing overlaps in malware, victimology, and command-and-control infrastructure.
The malware uses Swift and Rust stages, supports both Intel and ARM-based Macs, and establishes persistence through a macOS LaunchAgent. The operators used restrictive, nonstandard User-Agent validation to limit payload delivery and rapidly rotated command-and-control infrastructure to frustrate analysis and detection; no VirusTotal engines detected the variant when Elastic reported it.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Elastic analyzed a Swift- and Rust-based RUSTBUCKET variant that established LaunchAgent persistence, supported Intel and ARM macOS systems, collected host information, and could receive commands to execute uploaded Mach-O binaries or shell scripts. The sample had no VirusTotal antivirus detections at the time of Elastic's research.
After researchers collected Stage 2 and Stage 3 payloads, the operators replaced the C2 domain crypto.hondchain[.]com with starbucls[.]xyz. The campaign used strict custom User-Agent checks and returned HTTP 405 errors for requests lacking the required values.
The REF9135 campaign targeted a U.S.-headquartered cryptocurrency payment-services provider with a new macOS RUSTBUCKET variant. Elastic assessed with high confidence that the activity was linked to the DPRK-operated Lazarus Group and its financially motivated BlueNorOff sub-unit.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers attributed the **RustBucket** malware campaign to **Bluenoroff**, a North Korea-linked intrusion set tied to financially motivated operations, and reported that the group expanded the malware to target **macOS** alongside a **Windows .NET** variant. The infection chain used a fake PDF reader and a specially crafted PDF document to trigger malicious behavior, collect host information, and retrieve additional payloads from command-and-control infrastructure via HTTP `POST` requests. The campaign was linked to broader **SnatchCrypto** activity targeting cryptocurrency, fintech, venture capital, and other finance-related organizations across Asia, the United States, Europe, and the UAE. Investigators also connected the operation to phishing lures, typosquatting domains, and multiple delivery formats including **LNK, MSI, OneNote, VHD, CAB, and CHM** files, while the Windows variant was observed checking for antivirus products and using alternate execution paths such as `rundll32` or `explorer.exe` injection to load later stages.
Aug 14, 2026
North Korean-linked threat actor **BlueNoroff** has been observed targeting **macOS** users through lures tied to fake cryptocurrency news, extending the group’s financially motivated intrusion activity into Apple environments. The campaign used social engineering themes designed to appeal to crypto-focused victims, indicating continued interest in organizations and individuals involved in digital assets and related financial operations. Researchers reported that the operation also introduced **novel persistence** techniques on Macs, suggesting a more mature toolset for maintaining access after initial compromise. The activity highlights a growing risk to enterprises that rely on macOS endpoints in finance and cryptocurrency-adjacent workflows, where trusted news themes and investment-related content can be used to deliver malware and support long-term unauthorized access.
Jun 29, 2026
U.S. agencies and private researchers linked multiple cryptocurrency-focused malware campaigns to North Korea’s **Lazarus Group**/**HIDDEN COBRA**, including the **AppleJeus** family delivered through fake but functional trading and wallet applications for **Windows** and **macOS**. CISA reports said variants including **Celas Trade Pro**, **JMT Trading**, **Kupay Wallet**, and **CoinGoTrade** were distributed from spoofed or seemingly legitimate websites such as `celasllc.com`, `jmttrading.org`, and `kupaywallet.com`, often with GitHub-hosted installers. The applications presented benign trading interfaces while secretly installing updater, daemon, or backdoor components that collected host information, established persistence, and fetched encrypted second-stage payloads from attacker-controlled infrastructure. The malware gave operators remote access to victim systems in cryptocurrency exchanges, financial services firms, and related organizations, with capabilities including command execution, file upload and transfer, reconnaissance, and payload staging. CISA tied the campaigns to Lazarus through infrastructure and code overlap with known implants such as **FALLCHILL**, **HOPLIGHT/MANUSCRYPT**, and the **CrashReporter** backdoor, while Proofpoint documented related Lazarus activity using phishing documents, JavaScript downloaders, malicious `LNK` and `CHM` files, and backdoored cryptocurrency apps to deploy **PowerRatankba**, a custom **Gh0st RAT** variant, and **RatankbaPOS**. Together, the reporting shows a sustained Lazarus effort to steal cryptocurrency and gain access to crypto-sector networks by masquerading malware as legitimate trading software.
Aug 15, 2026