AppleJeus

AppleJeus is a notorious malware attributed to the North Korean hacker group, also known as Citrine Sleet. This group gained notoriety by distributing versions of AppleJeus malware primarily targeting cryptocurrency traders. The malware has evolved over time, with multiple versions being identified, including CoinGoTrade (Version 5), Dorusio (Version 6), Kupay Wallet (Version 4), Ants2Whale (Version 7), and JMT Trading (Version 2). In 2021, the Cybersecurity and Infrastructure Security Agency (CISA) reported on an AppleJeus attack wave called Kupay Wallet and identified a macOS Remote Access Trojan (RAT) dubbed prtspool used in one of the AppleJeus (CoinGoTrade) attack waves. The attribution to North Korea was made after researchers found overlapping code structures, identification function names, encryption keys, and similar execution flows with a previous AppleJeus backdoor. In 2022, Volexity identified a hostname as part of the AppleJeus campaign. Furthermore, researchers discovered that the PondRAT malware shares significant similarities with macOS malware used in a previous AppleJeus campaign attributed to the Gleaming Pisces APT group. An additional AppleJeus-related macOS RAT was found in a macOS sample previously attributed to be part of the poisoned Python packages campaign. In 2023, the Pyongyang AppleJeus hackers achieved notable success by exploiting the software supply chain. They inserted a flaw into an obsolete trading software package, which led them to compromise a desktop phone application made by 3CX and used by multinational corporations including Toyota, Coca-Cola, and Air France. This incident highlighted the group's ability to infiltrate and disrupt major corporate systems, underscoring the persistent threat posed by such malicious actors and the importance of robust cybersecurity measures.