ThaiCERT Threat Group Cards
Operation “AppleJeus” · 2018-08
Operation “AppleJeus” Target: Cryptocurrency exchange. Method: Fake installer and macOS malware. https://securelist.com/operation-applejeus/87553/
Operation “AppleJeus”
- Date (as written)
- 2018-08
- Year
- 2018
- Actors (as written)
- Lazarus Group, Hidden Cobra, Labyrinth Chollima
- Actor pages
- Lazarus GroupHidden CobraLabyrinth Chollima
Source entries (9)
CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)
Undisclosed cryptocurrency exchange · 2018-08-22
Kaspersky Lab reveals the details of Operation AppleJeus, an attack against cryptocurrency exchanges carried out via a trojanized cryptocurrency trading application distributing the Fallchill malware.
US court filing via CourtListener RECAP: United States v. Hyok
Celas Trade Pro malicious cryptocurrency application (AppleJeus) · Beginning on or before May 15, 2018
Overt Act No. 19: Beginning on or before May 15, 2018, defendant JON CHANG HYOK and other hackers developed Celas Trade Pro, which was purportedly cryptocurrency trading software, but which was, in reality, a malicious cryptocurrency application. [Case No. 2:20-cr-00614, U.S. District Court for the Central District of California; filing: SEALED INDICTMENT filed as to Jon Chang Hyok]
US court filing via CourtListener RECAP: United States v. Hyok
Celas Trade Pro advertised to cryptocurrency exchange employees · Beginning on June 18, 2018
Overt Act No. 20: Beginning on June 18, 2018, defendant JON CHANG HYOK and other hackers sent electronic communications advertising Celas Trade Pro to numerous employees of cryptocurrency exchanges. [Case No. 2:20-cr-00614, U.S. District Court for the Central District of California; filing: SEALED INDICTMENT filed as to Jon Chang Hyok]
CISA/FBI/Treasury advisory AA21-048A (AppleJeus: Analysis of North Korea's Cryptocurrency Malware)
AppleJeus Version 1: Celas Trade Pro (trojanized cryptocurrency application) · August 2018
AppleJeus Version 1: Celas Trade Pro Introduction and Infrastructure In August 2018, open-source reporting disclosed information about a trojanized version of a legitimate cryptocurrency trading application on an undisclosed victim's computer.
Hackmageddon cyber attacks timelines (Paolo Passeri)
Undisclosed cryptocurrency Exchange · 22/08/2018
Kaspersky Lab reveals the details of Operation AppleJeus, an attack against cryptocurrency exchanges carried out via a trojanized cryptocurrency trading application distributing the Fallchill malware.
UN Panel of Experts S/2020/151
Celas Limited / Celas Trade Pro trojanized trading application (Operation AppleJeus)
Para 181: “According to an analysis by one cybersecurity research firm, a Lazarus-backed attack against one cryptocurrency exchange relied on a “trojanized cryptocurrency trading application, which had been recommended to the company over email”. ... this hack by the Democratic People’s Republic of Korea used a legitimate-looking website and company name – Celas Limited – to distribute the malware-infected application. ... The application, Celas Trade Pro, executed a malicious update package when a user installed the application. The malware contained a “full-featured” backdoor trojan, which allowed full control over the victim’s system and theft of the cryptocurrency.” (footnote 187: Kaspersky, “Operation AppleJeus ...”, 23 August 2018)
Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
Celas Trade Pro fake cryptocurrency trading application (AppleJeus)
(MSMT/2025/2, report p. 15) “Citrine Sleet is notable for its practice of hardcoding the word “Jeus” into malware delivered to victims that downloaded a fake cryptocurrency trading application called Celas Trade Pro.”
Kaspersky Securelist
Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware · 2018-08-23T08:00:04
While investigating a cryptocurrency exchange attacked by Lazarus, we made an unexpected discovery. The victim had been infected with the help of a trojanized cryptocurrency trading application, which had been recommended to the company over email.