North Korean hackers drained ~$351M from Bitget - spoofed transfer data pushed through the exchange's own signing flow. https://intel.threadlinqs.com/threat/TL-2026-2650 #ThreatIntel #Volgmer #AppleJeus #Avalanche
September 25, 2026 at 11:54 AM
North Korean hackers drained ~$351M from Bitget - spoofed transfer data pushed through the exchange's own signing flow. https://intel.threadlinqs.com/threat/TL-2026-2650 #ThreatIntel #Volgmer #AppleJeus #Avalanche
Fox-IT has Citrine Sleet / AppleJeus’ number in a way that few other vendors do. Great job.
"Three Lazarus RATs coming for your cheese" published by Foxit. #Lazarus, #PondRAT, #RemotePE, #ThemeForestRAT, #DPRK, #CTI https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/
September 1, 2025 at 4:16 PM
Fox-IT has Citrine Sleet / AppleJeus’ number in a way that few other vendors do. Great job.
#FTSCon Speaker Spotlight: Daniel Gordon (@validhorizon.bsky.social) is presenting “When the AppleJeus GitHub is Worth the Squeeze: Citrine Sleet Investigation” in the HUNTER track.
See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...
See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...
September 19, 2025 at 3:34 PM
#FTSCon Speaker Spotlight: Daniel Gordon (@validhorizon.bsky.social) is presenting “When the AppleJeus GitHub is Worth the Squeeze: Citrine Sleet Investigation” in the HUNTER track.
See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...
See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...
This blog will probably go under the radar but AppleJeus is still around: medium.com/@RadiantCapi...
Radiant Capital Incident Update
2024–12–06
medium.com
December 9, 2024 at 8:50 PM
This blog will probably go under the radar but AppleJeus is still around: medium.com/@RadiantCapi...
that rule catches original AppleJeus/CrashUpdater sample, the UpdateAgent from 3CX , and POOLRAT
if we only use the dylib hash, we then catch PONDRAT that Unit42 just found
I could find no code overlap b/w UpdateAgent and the other fams
so im really stoked that these theories work!
if we only use the dylib hash, we then catch PONDRAT that Unit42 just found
I could find no code overlap b/w UpdateAgent and the other fams
so im really stoked that these theories work!
December 12, 2024 at 8:26 PM
that rule catches original AppleJeus/CrashUpdater sample, the UpdateAgent from 3CX , and POOLRAT
if we only use the dylib hash, we then catch PONDRAT that Unit42 just found
I could find no code overlap b/w UpdateAgent and the other fams
so im really stoked that these theories work!
if we only use the dylib hash, we then catch PONDRAT that Unit42 just found
I could find no code overlap b/w UpdateAgent and the other fams
so im really stoked that these theories work!
Lazarus Group isn't one entity, but an umbrella for NK state cyberattackers, per ZachXBT. Threats vary: basic recruitment/email scams vs. complex crypto attacks by select sub-groups like TraderTraitor & AppleJeus.
#crypto #blockchain #news
#crypto #blockchain #news
April 5, 2026 at 11:26 AM
Lazarus Group isn't one entity, but an umbrella for NK state cyberattackers, per ZachXBT. Threats vary: basic recruitment/email scams vs. complex crypto attacks by select sub-groups like TraderTraitor & AppleJeus.
#crypto #blockchain #news
#crypto #blockchain #news
Drift Protocol lost $285M in a hack linked to North Korean actors (UNC4736/AppleJeus). They exploited social engineering & dev tools. This highlights DeFi security flaws, especially in multisig wallets. Experts advise blockchain-level pre-transaction validation for defense. 🚨
Cryptovka
CryptoMarket and Blockchain News
cryptovka.com
April 6, 2026 at 9:53 AM
Drift Protocol lost $285M in a hack linked to North Korean actors (UNC4736/AppleJeus). They exploited social engineering & dev tools. This highlights DeFi security flaws, especially in multisig wallets. Experts advise blockchain-level pre-transaction validation for defense. 🚨
DWF Labs reportedly suffered a $44M hack in Sept 2022, allegedly by North Korean group AppleJeus. Stolen USDC/USDT was moved to Bitcoin & is now entering privacy mixers like Mixero, per researcher tanuki42. DWF Labs hasn't confirmed. #crypto #hack #NorthKorea
#blockchain #news
#blockchain #news
November 5, 2025 at 12:39 AM
DWF Labs reportedly suffered a $44M hack in Sept 2022, allegedly by North Korean group AppleJeus. Stolen USDC/USDT was moved to Bitcoin & is now entering privacy mixers like Mixero, per researcher tanuki42. DWF Labs hasn't confirmed. #crypto #hack #NorthKorea
#blockchain #news
#blockchain #news
📢 Vol de 280 M$ sur Drift : opération sophistiquée de 6 mois attribuée à UNC4736 (Corée du Nord)
📝 ## 🗓️ Contexte
Source : The Record Media, pub…
https://cyberveille.ch/posts/2026-04-14-vol-de-280-m-sur-drift-operation-sophistiquee-de-6-mois-attribuee-a-unc4736-coree-du-nord/ #AppleJeus #Cyberveille
📝 ## 🗓️ Contexte
Source : The Record Media, pub…
https://cyberveille.ch/posts/2026-04-14-vol-de-280-m-sur-drift-operation-sophistiquee-de-6-mois-attribuee-a-unc4736-coree-du-nord/ #AppleJeus #Cyberveille
April 14, 2026 at 8:00 AM
📢 Vol de 280 M$ sur Drift : opération sophistiquée de 6 mois attribuée à UNC4736 (Corée du Nord)
📝 ## 🗓️ Contexte
Source : The Record Media, pub…
https://cyberveille.ch/posts/2026-04-14-vol-de-280-m-sur-drift-operation-sophistiquee-de-6-mois-attribuee-a-unc4736-coree-du-nord/ #AppleJeus #Cyberveille
📝 ## 🗓️ Contexte
Source : The Record Media, pub…
https://cyberveille.ch/posts/2026-04-14-vol-de-280-m-sur-drift-operation-sophistiquee-de-6-mois-attribuee-a-unc4736-coree-du-nord/ #AppleJeus #Cyberveille
AppleJeus love affair with DPAPI continues. Great research by Fox-IT
blog.fox-it.com/2026/05/22/r...
blog.fox-it.com/2026/05/22/r...
RemotePE: The Lazarus RAT that lives in memory
Authors: Yun Zheng Hu and Mick Koomen Summary Last year, we published research1 about a North Korean Lazarus subgroup targeting financial and cryptocurrency organizations, encountered during multip…
blog.fox-it.com
May 27, 2026 at 10:25 AM
AppleJeus love affair with DPAPI continues. Great research by Fox-IT
blog.fox-it.com/2026/05/22/r...
blog.fox-it.com/2026/05/22/r...
April 3, 2025 at 9:27 AM
February 25, 2025 at 6:55 AM
暗号資産プラットフォームRadiant Capitalへの攻撃は北朝鮮偵察総局内のグループAppleJeus (Citrine Sleet)による。この攻撃により5000万ドル相当以上の暗号資産が盗まれた。 https://therecord.media/radiant-capital-heist-north-korea
North Korean hackers behind $50 million crypto heist of Radiant Capital
Researchers attributed the attack on the cryptocurrency platform to a group housed within North Korea’s Reconnaissance General Bureau (RGB).
therecord.media
December 12, 2024 at 7:51 AM
暗号資産プラットフォームRadiant Capitalへの攻撃は北朝鮮偵察総局内のグループAppleJeus (Citrine Sleet)による。この攻撃により5000万ドル相当以上の暗号資産が盗まれた。 https://therecord.media/radiant-capital-heist-north-korea
Группа Lazarus использует фальшивые криптовалютные приложения для распространения вредоносного ПО AppleJeus
https://kripta.biz/posts/E470364E-5BDC-4E84-B5F8-47C4AB0ABF08
https://kripta.biz/posts/E470364E-5BDC-4E84-B5F8-47C4AB0ABF08
April 3, 2025 at 9:27 AM
Группа Lazarus использует фальшивые криптовалютные приложения для распространения вредоносного ПО AppleJeus
https://kripta.biz/posts/E470364E-5BDC-4E84-B5F8-47C4AB0ABF08
https://kripta.biz/posts/E470364E-5BDC-4E84-B5F8-47C4AB0ABF08
Угрозы со стороны Lazarus: Как группа усовершенствовала атаки AppleJeus на криптовалюту
https://kripta.biz/posts/8547EE7A-844B-4525-9207-6207A0FB94FC
https://kripta.biz/posts/8547EE7A-844B-4525-9207-6207A0FB94FC
February 25, 2025 at 6:55 AM
Угрозы со стороны Lazarus: Как группа усовершенствовала атаки AppleJeus на криптовалюту
https://kripta.biz/posts/8547EE7A-844B-4525-9207-6207A0FB94FC
https://kripta.biz/posts/8547EE7A-844B-4525-9207-6207A0FB94FC
A $280M theft from Drift involved North Korean-linked attackers using fake companies, in-person trust-building, Telegram, and likely malicious code vectors to steal funds. The operation mimics a spy novel. #NorthKorea #CryptoHeist #SocialEngineering
‘It reads like a spy novel’: $280 million theft from Drift involved North Korean fake companies, cutouts
The Drift cryptocurrency platform disclosed a months-long, in-person social engineering operation that culminated on April 1 with the theft of more than $280 million. The attackers—linked to North Korean state-affiliated UNC4736 and the AppleJeus/Citrine Sleet operation—used fabricated professional identities, Telegram communications, and likely malicious TestFlight and code-repository vectors to compromise contributors...
www.hendryadrian.com
April 10, 2026 at 9:15 PM
A $280M theft from Drift involved North Korean-linked attackers using fake companies, in-person trust-building, Telegram, and likely malicious code vectors to steal funds. The operation mimics a spy novel. #NorthKorea #CryptoHeist #SocialEngineering
🚨 New Malware Report 🚨
AppleJeus malware is hijacking wallets & stealing funds. Don't be the next victim!
Read the report! 🔗 bit.ly/3QoD5hp
#CryptoSecurity #LazarusGroup #AppleJeus #WRAVEN
AppleJeus malware is hijacking wallets & stealing funds. Don't be the next victim!
Read the report! 🔗 bit.ly/3QoD5hp
#CryptoSecurity #LazarusGroup #AppleJeus #WRAVEN
WRAVEN | AppleJeus Report
A Report on the AppleJeus Malware from WRAVEN researchers
bit.ly
February 19, 2025 at 5:39 PM
🚨 New Malware Report 🚨
AppleJeus malware is hijacking wallets & stealing funds. Don't be the next victim!
Read the report! 🔗 bit.ly/3QoD5hp
#CryptoSecurity #LazarusGroup #AppleJeus #WRAVEN
AppleJeus malware is hijacking wallets & stealing funds. Don't be the next victim!
Read the report! 🔗 bit.ly/3QoD5hp
#CryptoSecurity #LazarusGroup #AppleJeus #WRAVEN
references to Network Service string
EHAGBPSL
XAgent
SeaDuke
AppleJeus
DTrack
MoriyaRootkit
Uroburos
good background on it : https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html?m=1
EHAGBPSL
XAgent
SeaDuke
AppleJeus
DTrack
MoriyaRootkit
Uroburos
good background on it : https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html?m=1
Sharing a Logon Session a Little Too Much
The Logon Session on Windows is tied to an single authent...
www.tiraniddo.dev
December 1, 2024 at 5:15 AM
references to Network Service string
EHAGBPSL
XAgent
SeaDuke
AppleJeus
DTrack
MoriyaRootkit
Uroburos
good background on it : https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html?m=1
EHAGBPSL
XAgent
SeaDuke
AppleJeus
DTrack
MoriyaRootkit
Uroburos
good background on it : https://www.tiraniddo.dev/2020/04/sharing-logon-session-little-too-much.html?m=1
DWF Institute claims to have lost $44 million due to North Korea’s AppleJeus-related hack
Market maker DWF Labs allegedly lost more than $44 million in a 2022 cyberattack by the North Korean-linked AppleJeus group. The revelations come amid a wave of state-sponsored attacks targeting the…
Market maker DWF Labs allegedly lost more than $44 million in a 2022 cyberattack by the North Korean-linked AppleJeus group. The revelations come amid a wave of state-sponsored attacks targeting the…
DWF Institute claims to have lost $44 million due to North Korea’s AppleJeus-related hack
Market maker DWF Labs allegedly lost more than $44 million in a 2022 cyberattack by the North Korean-linked AppleJeus group. The revelations come amid a wave of state-sponsored attacks targeting the cryptocurrency industry, with North Korean hackers attacking multiple platforms in recent years. This highlights that the sector remains vulnerable to advanced cybersecurity threats. Suspicions of connection between DWF Institute and 2022 cyber attack emerge…
earlybirdsinvest.com
November 11, 2025 at 3:03 AM
DWF Institute claims to have lost $44 million due to North Korea’s AppleJeus-related hack
Market maker DWF Labs allegedly lost more than $44 million in a 2022 cyberattack by the North Korean-linked AppleJeus group. The revelations come amid a wave of state-sponsored attacks targeting the…
Market maker DWF Labs allegedly lost more than $44 million in a 2022 cyberattack by the North Korean-linked AppleJeus group. The revelations come amid a wave of state-sponsored attacks targeting the…
Radiant Capital hacker transfers $10.8 million to Tornado Cash
The Radiant Capital hacker recently deposited 2,834 ETH into Tornado Cash, a mixer protocol, a year after abusing the project's financing pool, resulting in losses of $53 million. summary Radiant Capital hackers laundered $10.8 million…
The Radiant Capital hacker recently deposited 2,834 ETH into Tornado Cash, a mixer protocol, a year after abusing the project's financing pool, resulting in losses of $53 million. summary Radiant Capital hackers laundered $10.8 million…
Radiant Capital hacker transfers $10.8 million to Tornado Cash
The Radiant Capital hacker recently deposited 2,834 ETH into Tornado Cash, a mixer protocol, a year after abusing the project's financing pool, resulting in losses of $53 million. summary Radiant Capital hackers laundered $10.8 million worth of Ethereum through Tornado Cash, making it increasingly difficult for authorities to track stolen funds. Investigators suspect that the North Korean-linked group AppleJeus was behind the Radiant Capital attack.
earlybirdsinvest.com
October 29, 2025 at 8:33 AM
Radiant Capital hacker transfers $10.8 million to Tornado Cash
The Radiant Capital hacker recently deposited 2,834 ETH into Tornado Cash, a mixer protocol, a year after abusing the project's financing pool, resulting in losses of $53 million. summary Radiant Capital hackers laundered $10.8 million…
The Radiant Capital hacker recently deposited 2,834 ETH into Tornado Cash, a mixer protocol, a year after abusing the project's financing pool, resulting in losses of $53 million. summary Radiant Capital hackers laundered $10.8 million…
Radiant Capital Hacker almost doubles stolen funds through ETH transactions
The hackers behind last year's $53 million shining capital exploits have almost doubled the value of stolen funds through a well-timed Ethereum trading strategy. summary Radiant Capital Hacker has increased funds stolen…
The hackers behind last year's $53 million shining capital exploits have almost doubled the value of stolen funds through a well-timed Ethereum trading strategy. summary Radiant Capital Hacker has increased funds stolen…
Radiant Capital Hacker almost doubles stolen funds through ETH transactions
The hackers behind last year's $53 million shining capital exploits have almost doubled the value of stolen funds through a well-timed Ethereum trading strategy. summary Radiant Capital Hacker has increased funds stolen through ETH and DAI transactions from $53 million to $94 million. The October 2024 attack used Macos malware to exploit Radiant's multi-sig wallet. The attribution points to North Korea-related Applejeus with little chance of recovery.
earlybirdsinvest.com
August 25, 2025 at 5:39 PM
Radiant Capital Hacker almost doubles stolen funds through ETH transactions
The hackers behind last year's $53 million shining capital exploits have almost doubled the value of stolen funds through a well-timed Ethereum trading strategy. summary Radiant Capital Hacker has increased funds stolen…
The hackers behind last year's $53 million shining capital exploits have almost doubled the value of stolen funds through a well-timed Ethereum trading strategy. summary Radiant Capital Hacker has increased funds stolen…
