AppleJeus is the North Korean group behind the 3CX compromise, the first publicly reported case of one software supply chain attack triggering a second one, and its day job is stealing cryptocurrency. MITRE ATT&CK tracks it as G1049 and lists the aliases Citrine Sleet (Microsoft), Gleaming Pisces (Palo Alto Networks Unit 42), UNC4736 and UNC1720. This profile is for security teams at exchanges, trading firms, wallet providers and software vendors, and for anyone whose staff run trading or wallet software on corporate machines. It draws on ATT&CK v20, Microsoft, Mandiant, Unit 42 and JPCERT/CC, keeps each source's attribution wording, and spends most of its length on detection and hardening. For the wider North Korean picture, see the North Korea Cyber Operations Guide.
Key takeaways
- Revenue is the mission. ATT&CK describes the group's primary mission as generating and laundering revenue for the North Korean government, with the cryptocurrency industry as its main target.
- Trusted software is the delivery route. From trojanised wallet and trading apps to the 3CX desktop client, the group hides inside software that users and allowlists already trust.
- One compromised supplier can lead to another. Mandiant traced the 3CX build compromise back to an employee running a trojanised, end of life X_TRADER installer that was still signed with the vendor's certificate.
- Browsers and kernels are in scope. Microsoft attributes 2024 exploitation of the Chromium flaw CVE-2024-7971, chained with a Windows kernel flaw and the FudModule rootkit, to Citrine Sleet with medium confidence.
- Build systems and VPN accounts are identity targets. ATT&CK records that the 3CX intrusion used legitimate VPN credentials, and Mandiant says the attacker harvested credentials before reaching the Windows and macOS build environments.
Who they are (names and aliases)
ATT&CK describes AppleJeus as a North Korean state-sponsored group attributed to the Reconnaissance General Bureau, associated with the broader Lazarus Group umbrella, active since at least 2018 and closely aligned in resources with TEMP.Hermit. Mandiant's 2023 assessment of North Korean cyber structure says AppleJeus has overlap with TEMP.Hermit tooling but a different targeting profile, which it reads as a sign of shared resources. Mandiant assesses with moderate confidence that UNC4736, the cluster behind 3CX, is related to the AppleJeus activity.
| Name | Used by | Notes |
|---|---|---|
| AppleJeus (G1049) | MITRE ATT&CK | Group entry; aliases Gleaming Pisces, Citrine Sleet, UNC1720, UNC4736 |
| Citrine Sleet | Microsoft | Microsoft's naming table lists North Korea as origin and Storm-0139, Storm-1222 and LABYRINTH CHOLLIMA as other names; "Sleet" is Microsoft's family name for North Korea |
| Gleaming Pisces | Palo Alto Networks Unit 42 | Unit 42 ties it to the AppleJeus campaign and the POOLRAT and PondRAT backdoors |
| UNC4736; UNC1720 | Mandiant | UNC4736 for the 3CX activity; Mandiant's 2023 structure report lists AppleJeus as UNC1720 |
Two naming traps matter for analysts. First, ATT&CK also has a software entry, AppleJeus (S0584), for the downloader family that CISA described in 2021, and ATT&CK links that software to Lazarus Group (G0032) rather than to G1049. Second, JPCERT/CC treats AppleJeus as a campaign label and Citrine Sleet or Gleaming Pisces as the subgroup label. Searching intelligence feeds by every name in the table avoids missing reports. Microsoft also notes infrastructure and tool overlaps with Diamond Sleet, which it says may share the FudModule rootkit.
Malware and tools associated with the group
| Name | Type | Source and context |
|---|---|---|
| AppleJeus trojan | Trojanised crypto apps | Microsoft calls it Citrine Sleet's signature malware, used to collect what is needed to seize crypto assets |
| VEILEDSIGNAL, TAXHAUL, COLDCAT | Windows backdoor, loader, downloader | Mandiant, 3CX intrusion; TAXHAUL and COLDCAT persisted through DLL search order hijacking of the IKEEXT service |
| SUDDENICON, ICONICSTEALER | Downloader and browser data stealer | Mandiant, payloads in trojanised 3CX DesktopApp builds |
| POOLRAT; PondRAT | macOS and Linux backdoors | POOLRAT in the 3CX intrusion (Mandiant); PondRAT in malicious PyPI packages, February 2024 (Unit 42) |
| FudModule | Data-only kernel rootkit | Microsoft, 2024 Chromium exploit chain; also attributed to Diamond Sleet |
| FRP (S1144) | Public reverse proxy | Compiled copy dropped as MsMpEng.exe in System32 for lateral movement (Mandiant, ATT&CK C0057) |
Targeting and motivation
- Sectors: cryptocurrency businesses and the people who manage crypto assets (Microsoft, Mandiant, Unit 42). The 3CX campaign description in ATT&CK says follow-on targeting focused on defence and cryptocurrency victims.
- Motivation: financial theft for the state. ATT&CK maps the outcome to T1657 Financial Theft. Mandiant's structure report links the group's emergence to the difficulty of stealing and laundering traditional currency after earlier bank heists.
- Lures: Microsoft lists fake cryptocurrency trading sites, fake job applications and weaponised wallet or trading apps built from legitimate software. JPCERT/CC describes contact through social networks followed by a request to download a malicious PyPI package.
- Who should care: exchanges, OTC desks, market makers, wallet vendors, fintech developers and any software vendor whose builds reach those firms. The 3CX case shows a general business software vendor can be the stepping stone.
Notable activity
| Date | Activity | Source |
|---|---|---|
| Since at least 2018 | Spearphishing and fake cryptocurrency trading software to steal crypto assets | Mandiant; ATT&CK |
| February 2022 | Trading Technologies website compromised, first with a hidden IFRAME exploiting Chrome CVE-2022-0609, later serving a trojanised X_TRADER installer | Mandiant (citing Google TAG); ATT&CK C0057 |
| Late 2022 to March 2023 | 3CX supply chain attack: X_TRADER run inside 3CX, credentials harvested, Windows and macOS build environments compromised, DesktopApp 18.12.416 and earlier affected | Mandiant; ATT&CK C0057 |
| February 2024 | Malicious PyPI packages carrying PondRAT | Unit 42 |
| August 2024 | Chromium zero day CVE-2024-7971 exploited, Windows sandbox escape via CVE-2024-38106 and FudModule loaded; Microsoft identified exploitation on 19 August and Google fixed it on 21 August | Microsoft |
All three CVEs above are in the CISA Known Exploited Vulnerabilities catalog. For lessons from other cascading software compromises, see the Top 10 Supply Chain Attacks.
Tactics and techniques (MITRE ATT&CK)
ATT&CK v20 records two techniques directly against G1049 (T1657 and T1566). The rest of the table comes from the 3CX Supply Chain Attack campaign (C0057), which ATT&CK attributes to the group, plus the 2024 exploit chain as Microsoft describes it (marked NHIMG mapping).
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Initial access | T1566 Phishing | Spearphishing emails delivering payloads | Attachment and link detonation; report button |
| Initial access | T1189 Drive-by Compromise; T1203 Exploitation for Client Execution | Compromised vendor site with hidden IFRAME; Chrome CVE-2022-0609; in 2024 CVE-2024-7971 (NHIMG mapping) | Fast browser patching; browser isolation for high-risk roles |
| Initial access | T1195.002 Compromise Software Supply Chain | Trojanised X_TRADER, then trojanised 3CX builds | Software allowlisting with publisher and hash checks; retire end of life software |
| Initial access | T1078 Valid Accounts | Legitimate VPN credentials into the 3CX environment | Phishing-resistant MFA on VPN; device posture checks |
| Defence impairment | T1553.002 Code Signing | Installer signed with the vendor's genuine certificate | Do not treat a valid signature as proof of safety; watch for revoked or expiring certificates |
| Stealth | T1574.001 DLL; T1218.007 Msiexec; T1218.015 Electron Applications | Malicious ffmpeg.dll loaded by the signed app; IKEEXT search order hijack | Alert on unsigned or unexpected DLLs loaded by signed apps |
| Persistence | T1543.004 Launch Daemon; T1546.016 Installer Packages | POOLRAT via Launch Daemon; malicious .dylib in the macOS .dmg | macOS EDR, monitoring of /Library/LaunchDaemons |
| Stealth | T1678 Delay Execution | Payload sleeps one to four weeks before acting | Retro-hunt indicators over weeks, not days |
| Command and control | T1102.001 Dead Drop Resolver; T1071.001 Web Protocols | C2 address hidden in icon files on GitHub; data in HTTPS cookie headers | Egress allowlisting for servers; TLS inspection where lawful |
| Discovery and collection | T1217 Browser Information Discovery | ICONICSTEALER collects browser history and app configuration | Limit browsing on build and signing hosts |
| Privilege escalation (NHIMG mapping) | T1068 Exploitation for Privilege Escalation; T1014 Rootkit | CVE-2024-38106 sandbox escape and FudModule kernel tampering | Prompt Windows patching; vulnerable driver blocklist; HVCI |
| Impact | T1657 Financial Theft | Theft of digital assets | Transaction signing controls outside the endpoint |
For the technique classes, see MITRE ATT&CK T1189 Drive-by Compromise and MITRE ATT&CK T1566 Phishing.
How they abuse identities and credentials
- Remote access accounts: ATT&CK records that the 3CX intrusion used legitimate VPN credentials. A VPN that accepts a password and push approval from any device turns one stolen credential into network access. Require phishing-resistant MFA and device compliance.
- Build and release identities: Mandiant says the attacker harvested credentials, moved laterally and compromised both build environments. Build service accounts, signing keys and CI tokens should be reachable only from isolated build hosts, with signing in an HSM or managed signing service and every signing event logged. See the Software Supply Chain Security Guide.
- Code signing certificates: the X_TRADER installer carried Trading Technologies' genuine signature. Certificates for retired products should be revoked, and old products withdrawn from download sites.
- Browser data and sessions: ICONICSTEALER collected browser history and configuration, which can reveal internal systems and wallet services. Keep wallet and exchange administration in dedicated browsers or devices.
- Wallet keys and signers: the goal is assets. Keys that can move funds should sit behind multi-party approval and hardware signers, not on a trader's general-purpose laptop. See the Crypto Exchange Identity and Key Security Guide.
Detection and defence
What to monitor
| Signal | Data source | Why it matters |
|---|---|---|
| Signed applications loading unexpected or unsigned DLLs (for example ffmpeg.dll from an unusual path) | EDR image load events; Sysmon Event ID 7 | Core of the trojanised 3CX chain |
| Binaries named like security products in unusual paths (MsMpEng.exe outside the Defender folder) | EDR file and process events | FRP was disguised this way |
| Changes to the IKEEXT service DLL load path | EDR registry and image load events | Persistence through search order hijacking |
| Desktop apps reaching raw.githubusercontent.com or other code hosts | Proxy and DNS logs | Dead drop resolver for C2 |
| New Launch Daemons on macOS | macOS EDR; endpoint security framework events | POOLRAT persistence |
| Browser processes with child processes or kernel driver activity after visiting rare domains | EDR; Microsoft Defender alerts | 2024 browser to kernel chain |
| New PyPI or npm packages installed on developer hosts from unfamiliar publishers | Package proxy logs; EDR | PondRAT delivery via PyPI |
| VPN logins from new devices or unusual locations | VPN and IdP sign-in logs | Valid account use |
Microsoft lists Defender for Endpoint tamper protection, network protection, EDR in block mode and fully automated investigation and remediation, plus cloud-delivered protection in Defender Antivirus, among its mitigations for the 2024 chain. Mandiant published YARA and Snort rules for the 3CX malware, including the cookie markers used in C2 traffic.
Phased hardening plan
- Patch the browser fast: set an enterprise policy that forces Chrome and Edge restarts within days of a security release, and track exposure to KEV-listed browser flaws as a separate metric. See the Browser Security Hardening Guide.
- Control what runs: move trading and wallet software into an approved catalogue with publisher and hash rules in audit mode first, then enforce. Remove end of life applications.
- Isolate build and signing: no email or general browsing on build hosts, signing keys in an HSM, short-lived CI credentials and alerts on signing outside release windows. Keep the previous pipeline configuration for rollback.
- Harden remote access: phishing-resistant MFA and device compliance on VPN and admin portals, with conditional access tested on a pilot group first.
- Separate the money: hardware signers, multi-party approval and withdrawal allowlists so that a compromised endpoint cannot move funds alone.
- Hunt over long windows: because payloads can sleep for weeks, retro-hunt new indicators against at least 90 days of telemetry.
Decision guidance
- Software vendors: treat your build pipeline as a target. Signed provenance (for example SLSA-style attestations) and reproducible builds make tampering easier to spot.
- Crypto firms, small: keep treasury signing on dedicated hardware, use a managed browser with fast updates and refuse unsolicited "test" packages from recruiters.
- Crypto firms, large: add browser isolation for traders and admins, package proxies that block unknown PyPI or npm publishers, and threat hunting for the 3CX-era behaviours above.
Metrics
- Median time from a Chrome or Edge security release to 95 percent fleet adoption.
- Number of end of life applications still installed on corporate devices.
- Percentage of signing operations performed through an HSM or managed signing service.
- Percentage of VPN and admin logins using phishing-resistant MFA.
- Percentage of developer package installs routed through an approved package proxy.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Supply chain risk and software provenance | SR-3, SR-4, SR-11 | GV.SC-07 |
| Patch browsers and OS | SI-2, RA-5 | ID.RA-01, PR.PS-02 |
| Application allowlisting | CM-7, CM-10 | PR.PS-05 |
| Strong authentication for remote access | IA-2, AC-17 | PR.AA-03 |
| Monitoring and hunting | SI-4, AU-6 | DE.CM-09, DE.AE-02 |
Common failure patterns
- Trusting a valid signature: the X_TRADER and 3CX payloads both arrived inside properly signed software.
- Leaving retired software downloadable: a product discontinued in 2020 was still on the vendor's site in 2022 and became the first link in the chain.
- Short hunting windows: a payload that sleeps for weeks slips past a seven-day hunt.
- Build hosts used as workstations: credentials harvested from ordinary endpoints led into the build environments.
- Treating the browser as low risk: two Chromium flaws in this profile gave code execution from a web page.
Practitioner checklist
- Add every alias (AppleJeus, Citrine Sleet, Gleaming Pisces, UNC4736, UNC1720) to threat intelligence watch lists.
- Force browser updates within days and track KEV-listed browser flaws.
- Remove end of life trading and wallet software; allowlist the rest by publisher and hash.
- Isolate build and signing hosts and keep signing keys in an HSM.
- Require phishing-resistant MFA and device compliance for VPN access.
- Alert on signed apps loading unexpected DLLs and on new macOS Launch Daemons.
- Route developer package installs through a vetted proxy.
- Put fund movements behind hardware signers and multi-party approval.
- Retro-hunt new indicators over at least 90 days.
Standards and references
- MITRE ATT&CK: AppleJeus (G1049)
- MITRE ATT&CK: 3CX Supply Chain Attack (C0057)
- Microsoft: North Korean threat actor Citrine Sleet exploiting Chromium zero-day
- Mandiant: 3CX Software Supply Chain Compromise
- Mandiant: Assessed Cyber Structure and Alignments of North Korea in 2023
- Palo Alto Networks Unit 42: Threat Assessment, North Korean Threat Groups
- JPCERT/CC: Practical Challenges of Attribution in the Case of Lazarus's Subgroup
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Lazarus Group Threat Actor Profile · TraderTraitor (Jade Sleet) threat actor profile · APT38 Threat Actor Profile Guide · North Korea Cyber Operations Guide · Software Supply Chain Security Guide