type: intrusion-set
spec_version: 2.1
id: intrusion-set--14225573-63b5-4e50-ba9a-5fdcaf6a7b4c
created: 2025-08-25T21:13:24.851Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1049
external_id: G1049
source_name: UNC4736
description: (Citation: dtex DPRK 2025 structure ITworkers)(Citation: Mandiant 3cx UNC4736 2023)
source_name: UNC1720
description: (Citation: JPCert Blog Laz Subgroups 2025)(Citation: Mandiant DPRK Groups 2023)
source_name: Gleaming Pisces
description: (Citation: Unit42 DPRK Threat Groups 2024)
source_name: Citrine Sleet
description: (Citation: Unit42 DPRK Threat Groups 2024)
source_name: Mandiant 3cx UNC4736 2023
description: Jeff Johnson, Fred Plan, Adrian Sanchez, Renato Fontana, Jake Nicastro, Dimiter Andonov, Marius Fodoreanu, Daniel Scott. (2023, April 20). 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible. Retrieved August 25, 2025.
url: https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/
source_name: dtex DPRK 2025 structure ITworkers
description: Michael “Barni” Barnhart, DTEX, and Anonymous SMEs. (2025, May 14). Exposing DPRK's Cyber Syndicate and Hidden IT Workforce. Retrieved September 3, 2025.
url: https://reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf
source_name: Mandiant DPRK Groups 2023
description: Michael Barnhart, Austin Larsen, Jeff Johnson, Taylor Long, Michelle Cantos, Adrian Hernandez. (2023, October 10). Assessed Cyber Structure and Alignments of North Korea in 2023. Retrieved August 25, 2025.
url: https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023
source_name: Unit42 DPRK Threat Groups 2024
description: Unit 42. (2024, September 9). Threat Assessment: North Korean Threat Groups. Retrieved August 25, 2025.
url: https://unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups-2024/
source_name: JPCert Blog Laz Subgroups 2025
description: 佐々木勇人 Hayato Sasaki. (2025, March 25). Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus’s Subgroup. Retrieved August 25, 2025.
url: https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-23T20:42:03.446Z
name: AppleJeus
description: [AppleJeus](https://attack.mitre.org/groups/G1049) is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader [Lazarus Group](https://attack.mitre.org/groups/G0032) umbrella of actors, [AppleJeus](https://attack.mitre.org/groups/G1049) has been active since at least 2018 and is closely aligned in resources with TEMP.hermit, another DPRK-affiliated group under the same umbrella.(Citation: dtex DPRK 2025 structure ITworkers) The group’s primary mission is to generate and launder revenue to provide financial support to the government. [AppleJeus](https://attack.mitre.org/groups/G1049) primarily targets the cryptocurrency industry and is most notably responsible for the [3CX Supply Chain Attack](https://attack.mitre.org/campaigns/C0057).(Citation: Mandiant 3cx UNC4736 2023) The group traditionally deploys malicious cryptocurrency software in combination with [Phishing](https://attack.mitre.org/techniques/T1566). From these compromised environments, it selectively deploys additional backdoors to enable extended operations against high-value financial targets.(Citation: Mandiant DPRK Groups 2023)(Citation: JPCert Blog Laz Subgroups 2025)
aliases: AppleJeus
Gleaming Pisces
Citrine Sleet
UNC1720
UNC4736
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Michael “Barni” Barnhart, DTEX
Austin Larsen and the Google Threat Intelligence Group
x_mitre_domains: enterprise-attack