AppleJeusThreat actor
- gleaming pisces
- unc1720
- UNC4736
AppleJeus is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader Lazarus Group umbrella of actors, AppleJeus has been active since at least 2018 and is closely aligned in resources with TEMP.hermit, another DPRK-affiliated group under the same umbrella.From MITRE ATT&CK
Last reported 2 months ago, by Google Threat Intelligence1 report
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1176.002IDE Extensions
“Developer Workstation & IDE Compromise: Targeted social engineering, malicious IDE extensions, or typosquatted local dependencies designed to exfiltrate private cryptographic keys, API tokens, and local session credentials.”
- T1195Supply Chain Compromise
“Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise”
- T1195.001Compromise Software Dependencies and Development Tools
“…ents that GTIG tracked in 2025 and early 2026 involved the compromise of code repositories, software dependencies and developer tools (T1195.001).”
- T1195.002Compromise Software Supply Chain
“… high confidence that traditional software supply chain compromise, the manipulation of source code or update/distribution mechanisms (T1195.002), remains rare.”
- T1213.003Code Repositories
“…t impactful and far-reaching supply chain compromise incidents that GTIG tracked in 2025 and early 2026 involved the compromise of code repositories, software dependencies and developer tools (T1195.001).”
- T1553.002Code Signing
“Hardware-Backed Key Protection: Secure code-signing certificates using Hardware Security Modules (HSMs) or vaulting solutions.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise“…ussian cyber espionage actor ICE RELIC’s (formerly known as APT29) 2020 compromise of SolarWinds and North Korean cyber espionage actor UNC4736's 2023 compromise of 3CX.”
Indicators in its reports
named in the reports above- osv[.]devin 1 report
Copy this indicator · defanged
Thanks — we review every report.