Edit: BlueNoroff (APT38) — CryptoScamsWiki

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

> **On attribution:** BlueNoroff/APT38 is a North Korea-linked cluster within the Lazarus/RGB umbrella; attributions are those of the cited authorities and firms (U.S. Treasury, SentinelOne).

## Overview

BlueNoroff — also tracked as APT38, Stardust Chollima, and Sapphire Sleet — is a financially motivated unit within North Korea's Reconnaissance General Bureau, created to generate revenue as sanctions tightened. The U.S. Treasury sanctioned it (alongside Lazarus Group and Andariel) in September 2019, citing heists against foreign financial institutions, including via the SWIFT interbank system. [1]

## Activity

BlueNoroff/APT38 is most associated with bank-targeting operations such as the 2016 Bangladesh Bank heist (~$81 million taken) and attempted SWIFT thefts in numerous countries. Since the crypto era it has run a series of macOS-focused campaigns against cryptocurrency, DeFi, and fintech firms — including RustBucket, KandyKorn, and the 2024 "Hidden Risk" campaign documented by SentinelOne, which used fake crypto-news lures and a novel macOS persistence trick (abusing the `zshenv` file). [1][2]

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit