Celas Trade Pro

Celas Trade Pro is a malicious software application posing as a cryptocurrency trading platform. It was developed by North Korean hackers, referred to as HIDDEN COBRA by the U.S. government, as part of a series of deceptive applications collectively known as the "AppleJeus" family of malware. These applications, including Celas Trade Pro, WorldBit-Bot, Union Crypto Trader, Kupay Wallet, CoinGo Trade, Dorusio, CryptoNeuro Trader, and Ants2Whale, were developed and deployed from March 2018 through at least September 2020. The purpose of these apps was to provide backdoor access into the victims' computers, posing a significant cyber threat, particularly to the cryptocurrency sector. The Celas Trade Pro application is a modified version of the benign Q.T. Bitcoin Trader application. Available as an MSI Installer for Windows, it contained FALLCHILL as its final payload, a sophisticated piece of malware used for remote control over infected systems. The detailed analysis of this malicious program can be found in the MAR-10322463-1.v1 report published on the US-CERT website. Links between Celas Trade Pro and similar behaving infrastructure, such as TraderTraitor and other AppleJeus family members, have been noted by cybersecurity experts. This interconnectedness allows for trivial pivots among these infrastructures, further extending the potential reach and impact of these malicious applications. Public advisories and analysis reports related to these threats are available on the CISA website and GitHub.