Loading malware…
Jeus is a North Korea-linked malware family associated with GOLDEN CHOLLIMA and the broader AppleJeus activity cluster. First observed in 2018, it was used in campaigns that masqueraded as cryptocurrency-related software published by a fictitious company in order to compromise victims in the cryptocurrency and fintech ecosystem. A macOS counterpart, commonly tracked as AppleJeus, formed part of the same operational lineage. Jeus has been used against targets in the United States, South Korea, Europe, and other economically developed regions with significant digital-asset activity, and has been tied to operations intended to steal cryptocurrency from victim organizations and wallets. The malware is part of a specialized fintech-targeting toolkit within a DPRK cyber apparatus that also shares tooling heritage and infrastructure with other related clusters. High-confidence reporting links Jeus and AppleJeus to trojanized cryptocurrency software used as an initial infection vector and to financially motivated campaigns focused on sustained revenue generation through cryptocurrency theft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The adversary’s malware originates with Jeus in 2018 (and its macOS variant, AppleJeus), which originally masqueraded as a cryptocurrency application purportedly developed by the fictitious company Celas Limited.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A DPRK-linked malware family first seen in 2018 that masqueraded as a cryptocurrency application to target cryptocurrency entities.
Malware used to target fintech/crypto victims and drain cryptocurrency wallets.
Trojanized cryptocurrency-related application family used to compromise victims and facilitate cryptocurrency theft.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.