AppleJeus

AppleJeus is a potent malware designed to infiltrate systems and steal cryptocurrency-related assets. It was first identified by the Cybersecurity and Infrastructure Security Agency (CISA) in 2021 as part of a cryptocurrency-themed Kupay Wallet macOS malware package during an AppleJeus campaign. The malware has evolved over time, with versions such as AppleJeus Version 2: JMT Trading, Version 4: Kupay Wallet, Version 5: CoinGoTrade, Version 6: Dorusio, and Version 7: Ants2Whale. The malware can infect a system through deceptive tactics like fake job openings or by tricking victims into downloading a counterfeit crypto wallet or trading app laced with the AppleJeus Trojan. The malware is associated with the North Korea-linked group Citrine Sleet (also known as AppleJeus, Labyrinth Chollima, UNC4736, and Hidden Cobra), which targets the cryptocurrency industry for financial gain. This entity within Bureau 121 of North Korea's Reconnaissance General Bureau uses sophisticated techniques to breach security systems. For instance, it exploited the Google Chrome zero-day vulnerability CVE-2024-7971 to deploy the FudModule rootkit, as reported by Microsoft. Moreover, Citrine Sleet typically deploys its AppleJeus Trojan after gaining access to a targeted system. AppleJeus represents a significant threat to the global financial sector, particularly the burgeoning cryptocurrency industry. North Korean threat groups have reportedly stolen $2.3 billion USD between May 2017 and May 2023, with AppleJeus being a key tool in these thefts. Japan has been notably affected, accounting for 30% of the total amount stolen. Given its evolving nature and the considerable financial damage it has caused, robust cybersecurity measures are crucial to combat this malware.