AppleJeus

Summary

North Korean RGB group (MITRE G1049) active since at least 2018 that generates revenue by compromising cryptocurrency and fintech organisations, classically with trojanized trading and wallet applications (the 'AppleJeus' family). Microsoft calls it Citrine Sleet (formerly Storm-0139/Storm-1222); Mandiant's UNC4736 and Unit 42's Gleaming Pisces are the same cluster in MITRE's mapping. Its best-known operation is the 3CX double supply-chain compromise: a trojanized X_TRADER installer from Trading Technologies gave UNC4736 access to 3CX, whose signed desktop app then shipped malware to customers (late 2022–March 2023). In Oct 2024 it stole ~$50M from Radiant Capital after a Telegram-delivered 'contractor' PDF installed the INLETDRIFT backdoor on developers' machines (Mandiant). Microsoft linked an Aug 2024 Chromium zero-day (CVE-2024-7971) with the FudModule rootkit to Citrine Sleet at medium confidence. CrowdStrike now files AppleJeus-lineage tooling under GOLDEN CHOLLIMA, a steady, smaller-theft crypto/fintech unit split from LABYRINTH CHOLLIMA in Jan 2026.

Attribution

Part of the Lazarus umbrella

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Attributed to the Reconnaissance General Bureau

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 5

Malware and tools 6

Infrastructure patterns

• GitHub repo of icon files as dead-drop resolver for C2 in the 3CX attack (MITRE ATT&CK, 2026)
• Compromised vendor site tradingtechnologies[.]com hid an exploit IFRAME (MITRE ATT&CK, 2026)

Reporting and advisories 6

• MITRE ATT&CK
  AppleJeus (G1049)
• Mandiant
  3CX software supply chain compromise initiated by a prior supply chain compromise
• Microsoft Threat Intelligence
  Citrine Sleet exploiting Chromium zero-day
• CrowdStrike
  LABYRINTH CHOLLIMA evolves into three adversaries
• MITRE C0057
  3CX double supply-chain compromise via trojanized X_TRADER (MITRE C0057)
• Mandiant, via SecurityWeek
  Radiant Capital theft (~$50M) — Telegram "contractor" lure, INLETDRIFT