CISA, the FBI, and the U.S. Treasury attribute the Union Crypto version of AppleJeus to North Korean state-sponsored Lazarus Group actors targeting cryptocurrency users and companies. The operation distributed legitimate-looking Windows and macOS trading applications containing malicious updaters that collected system details and contacted unioncrypto.vip. Returned payloads were decrypted and executed in memory, while the Windows second stage supported file operations, command execution, screenshots, host enumeration, and remote configuration. CISA identified the distribution domain, a secondary command-and-control server at 216.189.150.185, and eight associated file hashes.