Sekoia.io analyzes Bluenoroff’s RustBucket activity as North Korea-nexus, financially motivated targeting of cryptocurrency, venture-capital, and related entities. The macOS chain installs a backdoored but functional PDF reader and requires a matching key PDF to decrypt C2 configuration and trigger a backdoor that profiles the host, contacts its C2 over HTTP POST, and requests commands. The report also identifies a Windows RustBucket variant using a fake PDF viewer with DevExpress components, DLL loading, antivirus checks, and process injection, showing Bluenoroff expanding cross-platform malware delivery around investment-themed lures.