Digital attackers used a strain of crypto malware called ‘AppleJeus’ to steal cryptocurrency.

In a joint advisory published by the FBI and the Department of the Treasury, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) warned that the Hidden Cobra threat group was using AppleJeus to target cryptocurrency exchanges, finance service companies and similar entities.

The malicious actors used trojanized versions of cryptocurrency trading apps to spread the crypto malware. From there, they could prey upon businesses and steal cryptocurrency from specific users’ wallets.

Read on to learn about the many times AppleJeus has appeared over the past few years.

The Seven Known Faces of AppleJeus

CISA used open-source techniques and other means to spot seven instances of Hidden Cobra’s AppleJeus crypto malware.

The first version emerged in August 2018. A version of a cryptocurrency trading app bearing the trojan infected an undisclosed victim’s computer. Bearing the name Celas Trade Pro, AppleJeus infected the victim with FALLCHILL. This remote administration tool let attackers remotely issue commands using a command-and-control server.

Next, CISA found that a phishing email from an LLC company had helped to distribute the trojan in the app.

The second instance of AppleJeus arrived more than a year later, in October 2019. At that time, a company called ‘JMT Trading’ marketed and spread the crypto malware. They claimed it was a cryptocurrency trading app. A download button on the website linked to the company’s GitHub page. There, victims could download the Windows and macOS versions of the crypto malware.

Crypto Malware Hides in Fake Trading Apps

Later that same year, a cybersecurity company formally detected the third iteration of AppleJeus. This time it was hiding inside a cryptocurrency trading app pushed out by a company called ‘Union Crypto’. The researchers did not spot any download links on the company’s website at the time of their work. However, a malware researcher discovered a download link that led to the macOS version. Meanwhile, open-source reporting suggested that the Windows version might have spread on Telegram channels.

The fourth version of the crypto malware arrived in March 2020. As with the cases described above, the malware relied on a fake company for distribution — Kupay Wallet, in this instance. The fake company’s domain used a valid SSL certificate at the time of the research. This might have been an attempt to lull visitors into a false sense of safety. But the certificate was only domain-control validated. That means the domain owners didn’t need to validate their identity or the actual business’s existence.

Two other fake companies called ‘CoinGoTrade’ and ‘Dorusio’ pushed out apps containing AppleJeus crypto malware at around the same time. Both of those entities also used a domain control validated SSL certificate, though the download links for the Dorusio variant resulted in 404 error messages at the time of analysis.

How to Defend Against Crypto Malware Like AppleJeus

In the first few months of 2020, Hidden Cobra used their crypto malware to target business entities and specific users in over 30 countries spread across five continents. These findings highlight the need for groups to defend themselves against crypto malware like AppleJeus. CISA recommended that they begin by investing in security awareness training that uses test attacks to educate their users about social engineering, spearphishing emails and other common digital threats.

CISA also noted that groups should consider using the principle of least privilege to limit the rights user accounts have. They should also patch vectors where threat actors might escalate their privilege in the system.

If you suspect your business has an AppleJeus crypto malware infection, there are some things you can do. CISA advised that you activate your incident response plans, remove any affected hosts from the network and contact the FBI, CISA or Department of the Treasury.

More from News

Abuse of Privilege Enabled Long-Term DIB Organization Hack

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network. During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network. Data breaches such as these are almost always the result of compromised endpoints…

Costa Rica State of Emergency Declared After Ransomware Attacks

In late April, after weeks of major ransomware attacks, Costa Rica declared a state of emergency. Newly-elected President Rodrigo Chaves took this measure, usually reserved to deal with natural disasters, to free up the government to react more decisively to the incident. The Russian-based Conti gang has claimed they launched the attack. Meanwhile, the U.S. Department of State offered a $10 million reward for information that leads to finding anyone holding a key leadership role in the Conti gang. The…

Ransomware-as-a-Service Transforms Gangs Into Businesses

Malware-as-a-Service is getting easier and easier to access, according to a recent threat report. Self-named the ‘Eternity Project’, this cyber threat group offers services from a Tor website and on their Telegram channel. They sell a wide variety of malware in an organized fashion, including stealer, clipper, worm, miner, ransomware and distributed-denial-of-service bot services. This alarms many security professionals. With Eternity, even inexperienced cyber criminals can target victims with a customized threat offering. Eternity sells malware for $90 to $490.…

UK Health System Email Accounts Hijacked to Steal Microsoft Logins

Last summer, I noticed password reset notices in my email account that I didn’t send. I quickly realized that I was the victim of an account takeover. This happens when someone illegally gains access to your account, typically through compromised credentials. I changed my email password right away and learned that my passwords to other accounts had already been changed. To make cleanup even more fun, I found out that the attackers had created new accounts using my credentials. Account…