Inside the BlueNoroff Web3 macOS Intrusion Analysis (Feeling Blue(Noroff))

Date (as written): 2025-06-18T05:00:00.000Z
Year: 2025
Actors (as written): TA444 aka BlueNoroff, Sapphire Sleet, COPERNICIUM, STARDUST CHOLLIMA, CageyChameleon
Actor pages: TA444 aka BlueNoroff Sapphire Sleet COPERNICIUM STARDUST CHOLLIMA CageyChameleon
Tags (as written): Web3 company; cryptocurrencies

Source entries (2)

Validin blog

Zooming through BlueNoroff Indicators (Huntress-reported Web3 macOS intrusion) · 2025-06-20T00:00:00Z

In a recent blog post ( Inside the BlueNoroff Web3 macOS Intrusion Analysis ), the Huntress research team detailed a targeted intrusion against a Web3 (cryptocurrency) organization that they attributed with high confidence to BlueNoroff. BlueNoroff, also known as APT38 , is a financially motivated subgroup of North Korea’s Lazarus Group.

https://www.validin.com/blog/zooming_through_bluenoroff_pivots/

Huntress blog

Inside the BlueNoroff Web3 macOS Intrusion Analysis (Feeling Blue(Noroff)) · 2025-06-18T05:00:00.000Z

We attribute with high confidence that this intrusion was conducted by the North Korean (DPRK) APT subgroup tracked as TA444 aka BlueNoroff, Sapphire Sleet, COPERNICIUM, STARDUST CHOLLIMA, or CageyChameleon—a state-sponsored threat actor known for targeting cryptocurrencies stemming back to at least 2017 .

https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis

Suggest a correction on GitHub