EuRepoC
The North Korean State-integrated Threat Actor Lazarus Launched Operation "AppleJeus Sequel" against Unspecified European and Chinese Targets · Not available
With Operation AppleJeus Sequel, the North Korean Lazarus Group specifically targeted the cryptocurrency sector. This operation - which is the continuation of the AppleJeus operation active in 2018 - which was analysed and reported by the Russian cybersecurity company Kaspersky in particular at the time, marked a strategic change in the group's methodology, adapting to different cybersecurity environments. The new operation, which has evolved technically, was observed and described by Securelist researchers. The operation was distinguished by the fact that it now focused on macOS users - which is a departure from the group's usual targets. The Lazarus Group developed and used specialised macOS malware and integrated an authentication mechanism to distribute the second stage payload more carefully. This ensures that the payload was delivered discreetly and accurately, leaving no trace on the hard drive. At the same time, Lazarus Group refined its strategy for Windows users by introducing a multi-stage infection process and significantly altering the final payload. Of the operations, victims were particularly identified in countries such as the UK, Poland, Russia and China.