Threat Actor Profile
Description
AppleJeusis a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broaderLazarus Groupumbrella of actors,AppleJeushas been active since at least 2018 and is closely aligned in resources with TEMP.hermit, another DPRK-affiliated group under the same umbrella.[1]The group’s primary mission is to generate and launder revenue to provide financial support to the government.AppleJeusprimarily targets the cryptocurrency industry and is most notably responsible for the3CX Supply Chain Attack.[2]The group traditionally deploys malicious cryptocurrency software in combination withPhishing. From these compromised environments, it selectively deploys additional backdoors to enable extended operations against high-value financial targets.[3][4]
Confidence Score
Tags
First Seen
Unknown
Last Updated
April 29, 2026
18 hours, 43 minutes ago
Active Status
ActiveCreated
April 29, 2026
MITRE ATT&CK Techniques (20)
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': [],
'description': 'AppleJeusis a North Korean state-sponsored threat group '
'attributed to the Reconnaissance General Bureau. Associated '
'with the broaderLazarus Groupumbrella of actors,AppleJeushas '
'been active since at least 2018 and is closely aligned in '
'resources with TEMP.hermit, another DPRK-affiliated group '
'under the same umbrella.[1]The group’s primary mission is to '
'generate and launder revenue to provide financial support to '
'the government.AppleJeusprimarily targets the cryptocurrency '
'industry and is most notably responsible for the3CX Supply '
'Chain Attack.[2]The group traditionally deploys malicious '
'cryptocurrency software in combination withPhishing. From '
'these compromised environments, it selectively deploys '
'additional backdoors to enable extended operations against '
'high-value financial targets.[3][4]',
'external_references': [{'external_id': 'G1049',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G1049/'}],
'id': 'threat-actor--G1049',
'metadata': {'crawled_at': '2026-04-29T14:32:26.970379+00:00',
'mitre_group_id': 'G1049',
'page_title': 'AppleJeus, Gleaming Pisces, Citrine Sleet, '
'UNC1720, UNC4736, Group G1049 | MITRE ATT&CK®'},
'name': 'AppleJeus',
'type': 'threat-actor'}