Citrine Sleet

Citrine Sleet, also known as Gleaming Pisces, AppleJeus, Labyrinth Chollima, UNC4736, and Hidden Cobra, is a threat actor believed to be associated with North Korea's Reconnaissance General Bureau. This group has been implicated in a series of targeted cyberattacks against the cryptocurrency industry, using sophisticated techniques and malware like the AppleJeus Trojan to infiltrate systems. Microsoft first disclosed Citrine Sleet's activities in a blog post in December 2022, highlighting their association with the AppleJeus campaign. In August 2024, Microsoft reported that Citrine Sleet was exploiting a Chromium zero-day vulnerability, CVE-2024-7971, for financial gain. The group used this vulnerability to launch attacks on cryptocurrency companies, leveraging the exploit as part of a multi-step attack process that began with a deceptive website mimicking a cryptocurrency trading platform. Once inside the system, Citrine Sleet would escalate its privileges by deploying FudModule, a rootkit shared with another APT, Diamond Sleet. Despite the complexity of these attacks and the requirement for local access to targeted machines (reflected in a CVSS score of 7.0), Microsoft managed to patch the exploited vulnerability (CVE-2024-38106) within a week of discovering Citrine Sleet's activities. However, the threat actor remained persistent, chaining its Chromium RCE exploit to a second high-severity bug. Detection of such activities becomes challenging due to the level of access the attacker achieves, placing them on an even playing field with endpoint security tools or even giving them an upper hand.