BlueNoroff (APT38)
A North Korea-linked, financially focused sub-group of the Lazarus umbrella that targets banks and crypto firms. Blamed for the 2016 Bangladesh Bank SWIFT heist and, more recently, macOS malware campaigns against crypto businesses (RustBucket, KandyKorn, 'Hidden Risk'). Sanctioned by the U.S. in 2019.
Also known as: BlueNoroff, APT38, Stardust Chollima, Sapphire Sleet, Hidden Risk, RustBucket
On attribution: BlueNoroff/APT38 is a North Korea-linked cluster within the Lazarus/RGB umbrella; attributions are those of the cited authorities and firms (U.S. Treasury, SentinelOne).
Overview
BlueNoroff — also tracked as APT38, Stardust Chollima, and Sapphire Sleet — is a financially motivated unit within North Korea's Reconnaissance General Bureau, created to generate revenue as sanctions tightened. The U.S. Treasury sanctioned it (alongside Lazarus Group and Andariel) in September 2019, citing heists against foreign financial institutions, including via the SWIFT interbank system. [1]
Activity
BlueNoroff/APT38 is most associated with bank-targeting operations such as the 2016 Bangladesh Bank heist (~$81 million taken) and attempted SWIFT thefts in numerous countries. Since the crypto era it has run a series of macOS-focused campaigns against cryptocurrency, DeFi, and fintech firms — including RustBucket, KandyKorn, and the 2024 "Hidden Risk" campaign documented by SentinelOne, which used fake crypto-news lures and a novel macOS persistence trick (abusing the zshenv file). [1][2]
Bracketed numbers refer to the numbered sources listed below.
People & entities involved
Sources (2)
- Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups — U.S. Department of the Treasury
- BlueNoroff 'Hidden Risk': Threat Actor Targets Macs with Fake Crypto News — SentinelOne
See also
- Ledger Connect Kit hackWallet drainersA December 2023 software supply-chain attack: a phished former Ledger employee's npm key let attackers publish malicious versions of Ledger's widely used 'Connect Kit' library, injecting the Angel Drainer into many dApps. About $500K–$600K was drained in a few hours before a fix shipped.
- Platypus FinanceProjectsAn Avalanche stablecoin protocol exploited for about $8.5M in February 2023 via a flash loan that abused a flawed solvency check. Two brothers were arrested in France (aided by ZachXBT) but were later acquitted of criminal charges by a French court.
- Angel DrainerWallet drainers
This page was last updated on Jun 15, 2026. View revision history.