Forensia CTI Core

Profile

AppleJeus is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader Lazarus Group umbrella of actors, AppleJeus has been active since at least 2018 and is closely aligned in resources with TEMP.hermit, another DPRK-affiliated group under the same umbrella. The group’s primary mission is to generate and launder revenue to provide financial support to the government. AppleJeus primarily targets the cryptocurrency industry and is most notably responsible for the 3CX Supply Chain Attack. The group traditionally deploys malicious cryptocurrency software in combination with Phishing. From these compromised environments, it selectively deploys additional backdoors to enable extended operations against high-value financial targets.

MITRE ATT&CK ↗

Techniques

2 ATT&CK techniques attributed to this actor.

T1566 Phishing T1657 Financial Theft

Related corpus activity

1,680 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to AppleJeus.

Indicator	Type	Family	Sev	Src
07cd03e2082bcb0b890cc59ce4c770d1a095ac6f1ae9cf999f5542555c56f841	sha256	phishing	80	1
b0e292346b4ab3f83fadd8abcce7cfc5b9d50ef73ad141e8bc4a4689fee13504	hash	ransomware	80	2
69315b7a1c4bf5ee56cba1de29d1761e	hash	cryptojacking	80	2
3d510977d60a44322f88100b515f06cb5ed83babc64247068d1a489595faa6c5	sha256	phishing	80	1
3e7066e44132e64360a30974b6ea3671	hash	—	80	3
40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5	hash	—	80	3
50eda29bfbeeb8b0429718447725016a	hash	cryptojacking	80	2
5d253cc263851ec68c0a988bf86afbb3e9f0b491	hash	cryptojacking	80	2
e84b1e2c432b2394c403b524b8361ffa9923a022eb05215f1dc811bc167c3c5e	hash	cryptojacking	80	2
c5a53c02d531c5e46f9cc2fc0afbb88d	hash	cryptojacking	80	2
41f581f7d2c09ab0edfea850b9db506f	hash	cryptojacking	80	2
a08d8e63b0cd3638fb40b8e6da546e26da69439597565827f9cec87915f78568	sha256	ransomware	80	1
e20b35a8c30e076cdd0e1df05ba1ff2e418dbd39a674f084787cc0af2fda9e95	sha256	phishing	80	1
b90988400cced319d260c4937f334ecc364785ed5c593cd2139965e62ca58173	sha256	phishing	80	1
bd46890121106b43f0c01ab82629400c	hash	cryptojacking	80	2
579a82dde4425d95e20a22171be0a37702c833fdca6e5e04f69099a025863136	hash	cryptojacking	80	2
ce62d1b6116f34f9ba815db1e2016d2a	hash	cryptojacking	80	2
1fc5e6458316277fae8272cbe9f3dfc86b681635	hash	cryptojacking	80	2
89930bd18e0f9c9c98dfb1662cb87aa98348e87164ab62b1f39e86ebf2ce24cb	hash	cryptojacking	80	2
b5da6ffa5f85aa5016fbc02a3122361c85d21192c45df9544099d13e6ff84c36	hash	cryptojacking	80	2
d42aecf76fb1531cd5b7139e669910b2fd82a90b7e11448128e226775bf5d42e	hash	cryptojacking	80	2
b6a77b7892ef22d6afd91eb980a3f3d8	hash	cryptojacking	80	2
a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b	sha256	phishing	80	1
462af0a3a9094d44c30cc65544ec1171a62365cff09e67f5e87e061a3d604bd0	hash	cryptojacking	80	2
3d1158884fb339b3328bd330fcc27598e1f1c94bcac39e75d1a272afa4deee1a	sha256	ransomware	80	1
a14bed1c46ba7406d5240e979251ccd394dfe3b5	hash	cryptojacking	80	2
93b3d3925ccc201ab0f16017153a79ef05b8f5c2	hash	cryptojacking	80	2
a37f6403fbf28fa0b48863287f4c5a5d	hash	cryptojacking	80	2
670384fafb23140d96f2f8fe04a13fc8cc8e2a6e5e8c973e39b58d103c5fea92	sha256	phishing	80	1
87480b151e465b73151220533c965f3a77046138f079ca3ceb961a7d5fee9a33	hash	—	80	1

Showing the top 30 by severity of 1,680.