Citrine Sleet

Citrine Sleet, also known as Gleaming Pisces, is a financially motivated threat actor associated with North Korea that has been active since at least 2018. The group is renowned for distributing the AppleJeus malware, targeting cryptocurrency traders. They have previously been linked to various cyber-attacks on the cryptocurrency industry and are known for their use of the macOS remote administration tool POOLRAT. Citrine Sleet has also been associated with several aliases such as Labyrinth Chollima, UNC4736, and Hidden Cobra, further complicating tracking efforts. In 2024, Citrine Sleet exploited the Chromium zero-day vulnerability, CVE-2024-38106, directing targets to their controlled exploit domain voyagorclub[.]space. Despite initial reports linking this exploit activity to the aforementioned CVE, investigations have not found any direct link beyond exploiting the same vulnerability. The group used typical stages seen in browser exploit chains to carry out this zero-day exploit attack. They also exploited another Google Chrome zero-day, CVE-2024-7971, deploying the FudModule rootkit. Citrine Sleet's activities pose significant risks, particularly to the cryptocurrency industry, given their focus on this sector and their use of sophisticated techniques such as exploiting zero-day vulnerabilities. Despite the patching of the exploited vulnerabilities, the group's evolving tactics and persistent attacks underscore the need for robust cybersecurity measures, including regular software updates, comprehensive threat intelligence, and proactive defense strategies.