CISA, the FBI, and the U.S. Treasury attribute Ants2Whale to North Korea’s Lazarus Group and describe it as an AppleJeus variant used in cryptocurrency-targeting operations. The macOS installer presents a functional cryptocurrency application while deploying Ants2Whale and a persistent helper component through a LaunchDaemon. The two executables communicate with `45.147.231.77:3000` and `qnalytica.com/wp-rss.php`, respectively. CISA published file hashes, domains, and command-and-control infrastructure for detection and response.