# Sapphire Sleet (DPRK/BlueNoroff) macOS Intrusion Campaign Targeting Cryptocurrency, Web3, and Venture Capital Sectors

> North Korean state-sponsored group Sapphire Sleet (aka BlueNoroff, TA444, COPERNICIUM, APT38 subcluster) is running an active macOS intrusion campaign against cryptocurrency exchanges, Web3 startups, and venture capital firms. Operators pose as investors and recruiters on LinkedIn and Telegram, delivering signed Swift/Rust malware loaders (RustBucket, KANDYKORN, ObjCShellz, SwiftLoader) that abuse launch agents for persistence, dump the macOS Keychain, and exfiltrate cryptocurrency wallets. Microsoft, Mandiant, and CISA (AA26-104A) have confirmed active exploitation in April 2026.

- **Published:** 2026-04-16T12:00:00Z
- **Last reviewed:** 2026-04-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0383
- **ID:** TL-2026-0383
- **Severity:** HIGH (CVSS 8.1)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT38 (North Korea)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Sapphire Sleet — Microsoft's designation for the DPRK financially motivated cluster also tracked as BlueNoroff (Kaspersky), TA444 (Proofpoint), COPERNICIUM (legacy Microsoft), Stardust Chollima (CrowdStrike), and an APT38 offshoot — has expanded its macOS toolkit in a campaign running from early Q1 2026 into April 2026. Unlike prior BlueNoroff operations that relied heavily on weaponized Office documents, the 2026 wave favors native macOS binaries signed with stolen or fraudulently obtained Apple Developer IDs (revoked by Apple on 2026-04-13 following Microsoft's private disclosure).

Initial access begins with long-running social engineering operations on LinkedIn and Telegram, in which actors impersonate venture capitalists, crypto investors, or recruiters from legitimate firms (a16z, Paradigm, Sequoia Crypto, Binance Labs). After multi-week rapport-building, the target is invited to a fake investor meeting or receives a signed macOS application disguised as a PDF viewer, meeting-scheduling app, or NDA reviewer. Observed loader families include: RustBucket (a Rust-compiled stage-1 loader that retrieves a Mach-O from a remote server over HTTPS), KANDYKORN (a Python-orchestrated multi-stage implant first disclosed by Elastic Security in 2023, now observed with new anti-analysis checks including Virtualization.framework detection), ObjCShellz (an Objective-C reverse shell), and the newly named SwiftLoader (Swift-compiled dropper using NSURLSession over TLS 1.3).

Post-compromise tradecraft includes launch agent and launch daemon persistence (~/Library/LaunchAgents/com.apple.systempreferences.plist, /Library/LaunchDaemons/com.apple.softwareupdated.plist), AppleScript (osascript) execution for privilege elevation prompts that spoof system dialogs, macOS Keychain extraction via the security find-generic-password binary, and targeted theft of Chrome, Brave, Edge, and Arc browser extension data corresponding to MetaMask, Phantom, Trust Wallet, and Coinbase Wallet. Exfiltration uses HTTPS POSTs to actor-controlled infrastructure hosted predominantly on Stark Industries, FlokiNET, and low-reputation Russian hosters, with domains typosquatting venture capital and crypto firm names. Mandiant reports at least seven crypto firms confirmed compromised and losses exceeding 47 million USD attributable to this cluster in Q1 2026 alone, with proceeds assessed to fund DPRK weapons and missile programs per multiple UN Panel of Experts reports.

Defenders should treat unsolicited LinkedIn/Telegram recruiter and investor outreach to employees holding crypto wallet access or deployment keys as high-risk, enforce Gatekeeper and Developer ID verification checks, hunt for unexpected launch agents in user Library paths, and monitor for osascript spawning network child processes. CISA advisory AA26-104A provides sector-wide mitigations and mandates FCEB attestation of defensive controls for agencies with crypto or blockchain exposure by 2026-05-14.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1598 Phishing for Information
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1553 Subvert Trust Controls
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Microsoft: Sapphire Sleet Expands macOS Toolkit Against Crypto Sector](https://www.microsoft.com/en-us/security/blog/threat-intelligence/)
- [Mandiant: BlueNoroff macOS Campaign Tradecraft Update](https://cloud.google.com/blog/topics/threat-intelligence/)
- [CISA Alert AA26-104A: DPRK Targeting of Cryptocurrency Sector](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-104a)
- [Elastic Security Labs: KANDYKORN Technical Analysis (historical baseline)](https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn)
- [Jamf Threat Labs: RustBucket Evolution and Hunting Guide 2026](https://www.jamf.com/blog/jamf-threat-labs/)
- [Kaspersky SecureList: BlueNoroff SnatchCrypto campaign overview](https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/)
- [UN Panel of Experts Report S/2024/215 on DPRK sanctions evasion via crypto theft](https://www.un.org/securitycouncil/sanctions/1718/panel_experts/reports)
- [US Treasury OFAC designation of Lazarus Group and affiliated DPRK operators](https://ofac.treasury.gov/recent-actions)
- [MITRE ATT&CK Group: BlueNoroff (G0098)](https://attack.mitre.org/groups/G0098/)
- [SentinelOne: Hunting macOS Malware with Launch Agent and Daemon Telemetry](https://www.sentinelone.com/labs/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0383