LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0584: AppleJeus

AppleJeus is a family of downloaders initially discovered in 2018 embedded within trojanized cryptocurrency applications. AppleJeus has been used by Lazarus Group, targeting companies in the energy, finance, government, industry, technology, and telecommunications sectors, and several countries including the United States, United Kingdom, South Korea, Australia, Brazil, New Zealand, and Russia. AppleJeus has been used to distribute the FALLCHILL RAT.[1]

EnterpriseS0584MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

AppleJeus matters because it represents trojanized application delivery of downloader malware on Windows and macOS, originally observed in cryptocurrency-themed applications. For leaders, the practical issue is not only malware blocking; it is whether the organization can validate software trust, user-driven execution, installer behavior, persistence creation, and outbound web-based command-and-control activity across both endpoint platforms.

Executive priority

Prioritize this as a software supply-chain and endpoint resilience concern where Windows or macOS users install third-party applications, especially in business areas exposed to finance, cryptocurrency, technology, government, energy, industry, or telecommunications themes referenced by ATT&CK. Executives should ask whether controls can prove: users are protected from malicious links/files, installers and code signing are assessed, persistence changes are monitored, and incident responders can reconstruct activity when files are hidden, deleted, or obfuscated.

Technical view

ATT&CK provides no standalone detection text for AppleJeus, so validation should be relationship-driven. SOC and detection teams should test coverage for spearphishing links and user execution, suspicious installer package behavior, msiexec abuse on Windows, launchctl and Launch Daemon activity on macOS, Windows service and scheduled task creation, UAC bypass indicators, hidden/deleted/obfuscated files, system discovery, time-based sandbox evasion, and HTTP/S-style C2 with possible exfiltration over the same channel. Because AppleJeus is described as a downloader that has distributed FALLCHILL, investigations should treat downloader activity as a potential precursor to additional payloads rather than as a complete incident scope.

Likely telemetry

  • Endpoint process creation telemetry for Windows and macOS
  • Windows service creation/modification events
  • Windows scheduled task creation and execution events
  • macOS launchctl usage and Launch Daemon plist changes
  • Installer package execution and pre/post-install script activity

Detection direction

  • Correlate user-click or downloaded-application events with installer execution and immediate persistence creation.
  • Tune for suspicious msiexec, scheduled task, and Windows service activity, while accounting for legitimate software deployment noise.
  • On macOS, monitor launchctl activity and Launch Daemon creation or modification, especially following new application installation.
  • Review code signing context, not just signature presence, because the related Code Signing technique indicates signed code can still be abused.
  • Look for hidden files, file deletion, and obfuscated/deobfuscated content as investigation pivots, not isolated high-confidence alerts.

Mitigation priorities

  • Strengthen user-facing controls for malicious links and files, including email/web filtering and user reporting workflows.
  • Restrict or govern installation of unapproved third-party applications on Windows and macOS where business feasible.
  • Harden installer execution paths and monitor installer scripts that inherit elevated permissions.
  • Enforce least privilege and reduce routine local administrator use to limit UAC bypass, service creation, Launch Daemon installation, and installer persistence opportunities.
  • Require endpoint telemetry coverage for both Windows and macOS persistence mechanisms before claiming detection readiness.
Additional notes and limits

The supplied ATT&CK object identifies AppleJeus as a downloader family embedded in trojanized cryptocurrency applications, used by Lazarus Group, and associated with Windows and macOS. The most useful defensive interpretation comes from the listed technique relationships, which span initial access, execution, persistence, privilege escalation, stealth, discovery, command and control, and exfiltration behaviors.

MITRE does not provide official detection text for this object, and the object itself lists no tactics. This take therefore avoids asserting specific detection coverage or current activity. Local software inventory, endpoint logging depth, email/web telemetry, and macOS/Windows control maturity are required to determine real exposure and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

AppleJeus

AppleJeus is a family of downloaders initially discovered in 2018 embedded within trojanized cryptocurrency applications. AppleJeus has been used by Lazarus Group, targeting companies in the energy, finance, government, industry, technology, and telecommunications sectors, and several countries including the United States, United Kingdom, South Korea, Australia, Brazil, New Zealand, and Russia. AppleJeus has been used to distribute the FALLCHILL RAT.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

20 rows
DomainIDNameRelationship / procedure
EnterpriseT1140Deobfuscate/Decode Files or Information

AppleJeus has decoded files received from a C2.[1]

EnterpriseT1070.004File DeletionSub-technique

AppleJeus has deleted the MSI file after installation.[1]

EnterpriseT1546.016Installer PackagesSub-technique

During AppleJeus's installation process, it uses `postinstall` scripts to extract a hidden plist from the application's `/Resources` folder and execute the `plist` file as a Launch Daemon with elevated permissions.[2]

EnterpriseT1041Exfiltration Over C2 Channel

AppleJeus has exfiltrated collected host information to a C2 server.[1]

EnterpriseT1566.002Spearphishing LinkSub-technique

AppleJeus has been distributed via spearphishing link.[1]

EnterpriseT1543.003Windows ServiceSub-technique

AppleJeus can install itself as a service.[1]

EnterpriseT1564.001Hidden Files and DirectoriesSub-technique

AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings.[1]

EnterpriseT1569.001LaunchctlSub-technique

AppleJeus has loaded a plist file using the launchctl command.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

AppleJeus has sent data to its C2 server via POST requests.[1][2]

EnterpriseT1553.002Code SigningSub-technique

AppleJeus has used a valid digital signature from Sectigo to appear legitimate.[1]

EnterpriseT1059.004Unix ShellSub-technique

AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.[1][2]

EnterpriseT1082System Information Discovery

AppleJeus has collected the victim host information after infection.[1]

EnterpriseT1218.007MsiexecSub-technique

AppleJeus has been installed via MSI installer.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.[1]

EnterpriseT1548.002Bypass User Account ControlSub-technique

AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.[1]

EnterpriseT1204.002Malicious FileSub-technique

AppleJeus has required user execution of a malicious MSI installer.[1]

EnterpriseT1027Obfuscated Files or Information

AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.[1]

EnterpriseT1497.003Time Based ChecksSub-technique

AppleJeus has waited a specified time before downloading a second stage payload.[1]

EnterpriseT1543.004Launch DaemonSub-technique

AppleJeus has placed a plist file within the LaunchDaemons folder and launched it manually.[1][2]

EnterpriseT1204.001Malicious LinkSub-technique

AppleJeus's spearphishing links required user interaction to navigate to the malicious website.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1546.016: Installer PackagesEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1564.001: Hidden Files and DirectoriesEnterpriseuses · TechniqueT1569.001: LaunchctlEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1218.007: MsiexecEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · GroupG0032: Lazarus GroupEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1543.004: Launch DaemonEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
f4d42ce75d8f579e...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundlef4d42ce75d8f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  2. [2]
    ObjectiveSee AppleJeus 2019

    Patrick Wardle. (2019, October 12). Pass the AppleJeus. Retrieved September 28, 2022.

    Open source URL
  3. [3]
    AppleJeus

    (Citation: CISA AppleJeus Feb 2021)

  4. [4]
    AppleJeus

    (Citation: CISA AppleJeus Feb 2021)

  5. [5]
    AppleJeus

    (Citation: CISA AppleJeus Feb 2021)

  6. [6]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  7. [7]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  8. [8]
    mitre-attackS0584
    Open source URL
  9. [9]
    mitre-attackS0584
    Open source URL
  10. [10]
    mitre-attackS0584
    Open source URL
  11. [11]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  12. [12]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  13. [13]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  14. [14]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  15. [15]
    ObjectiveSee AppleJeus 2019

    Patrick Wardle. (2019, October 12). Pass the AppleJeus. Retrieved September 28, 2022.

    Open source URL
  16. [16]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  17. [17]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  18. [18]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  19. [19]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  20. [20]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  21. [21]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  22. [22]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  23. [23]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  24. [24]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  25. [25]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  26. [26]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  27. [27]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  28. [28]
    ObjectiveSee AppleJeus 2019

    Patrick Wardle. (2019, October 12). Pass the AppleJeus. Retrieved September 28, 2022.

    Open source URL
  29. [29]
    ObjectiveSee AppleJeus 2019

    Patrick Wardle. (2019, October 12). Pass the AppleJeus. Retrieved September 28, 2022.

    Open source URL
  30. [30]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  31. [31]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  32. [32]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  33. [33]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  34. [34]
    ObjectiveSee AppleJeus 2019

    Patrick Wardle. (2019, October 12). Pass the AppleJeus. Retrieved September 28, 2022.

    Open source URL
  35. [35]
    ObjectiveSee AppleJeus 2019

    Patrick Wardle. (2019, October 12). Pass the AppleJeus. Retrieved September 28, 2022.

    Open source URL
  36. [36]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  37. [37]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  38. [38]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  39. [39]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  40. [40]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  41. [41]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  42. [42]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  43. [43]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  44. [44]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  45. [45]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  46. [46]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  47. [47]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  48. [48]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  49. [49]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
  50. [50]
    ObjectiveSee AppleJeus 2019

    Patrick Wardle. (2019, October 12). Pass the AppleJeus. Retrieved September 28, 2022.

    Open source URL
  51. [51]
    CISA AppleJeus Feb 2021

    Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use