⌘K

AppleJeus (aka AppleJeus, Gleaming Pisces) · APT Atlas

Actors/Nation-state / APT/Asia

AppleJeus

APTKP · North Korea

AKA Gleaming Pisces · Citrine Sleet · Labyrinth Chollima · Nickel Academy · Hidden Cobra · Lazarus Group · TraderTraitor · Sapphire Sleet · CryptoCore

CrowdStrike: LABYRINTH CHIMERAESET: LazarusKaspersky: BlueNoroffMandiant: UNC4736Microsoft: DEV-0139Secureworks: IRON CURSOR

DPRK financially-motivated cluster targeting cryptocurrency.

Targets25

Sectors18

Threat types1

GIRs mapped0/480

Active since2018

Explore in atlas

Export

STIX 2.1 ATT&CK Navigator

QUICK FACTS

TypeNation-state / APT

OriginNorth Korea

First seen2018

Type (verbatim)nation-state APT

GIR mappings0/480

TTPs2

Targets25

Sectors18

Record updated2026-08-03

Also tracked as

6 vendor names · 9 other aliases

Open Rosetta Stone

CrowdStrike

LABYRINTH CHIMERA

ESET

Lazarus

Kaspersky

BlueNoroff

Mandiant

UNC4736

Microsoft

DEV-0139

Secureworks

IRON CURSOR

UNATTRIBUTED ALIASESGleaming PiscesCitrine SleetLabyrinth ChollimaNickel AcademyHidden CobraLazarus GroupTraderTraitorSapphire SleetCryptoCore

Victimology

Geographic footprint · 25 countries

Export STIX

origin · North Koreatargeted countries · 25

AMERICAS · 3

Argentina · Brazil · Canada

EUROPE · 14

Belgium · Germany · Denmark · Estonia · Spain · United Kingdom · Hungary · Italy · Netherlands · Poland · Russia · Sweden · Slovenia · Ukraine

ASIA · 6

Israel · India · Japan · South Korea · Türkiye · Vietnam

OCEANIA · 1

New Zealand

AFRICA · 1

South Africa

Sectors targeted

18 of 40

Government100 actors Defense72 actors Aerospace58 actors Financial Services73 actors Cryptocurrency20 actors Pharmaceutical26 actors Telecom71 actors Energy / Utilities58 actors Education & Research62 actors Manufacturing (man)49 actors Media & Journalism48 actors Transportation31 actors Consulting / Professional Services34 actors Industrials / Engineering28 actors Private Sector (generic)29 actors Consumer Goods / Electronics19 actors Agriculture & Food18 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

FIN · Financial Fraud

MITRE ATT&CK · 2 techniques

Initial Access · 1

T1566Phishing

Impact · 1

T1657Financial Theft

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer2 techniques · layer format 4.5

Related actors

By origin and actor type

Agriusnation-state

Iran · 2 targets · since 2020

APT1nation-state

China · 17 targets · since 2006

APT10nation-state

China · 19 targets · since 2009

APT12nation-state

China · 11 targets · since 2009

APT14nation-state

China · 15 targets · since —

APT15nation-state

China · 25 targets · since 2010