BlueNoroff (otherwise known as Saphire Sleet or APT38), a North Korean-linked hacking group, has been attributed to targeting financial institutions with a new undocumented malware strain targeting macOS. BlueNoroff is an advanced persistent threat (APT) group that is a subgroup of North Korea’s notorious Lazarus Group. Having been first recognized in 2014, the threat group is known to run typical North Korean cyber campaigns focused on attacking financial institutions, cryptocurrency companies, and military entities in leu of growing their nuclear weapons and ballistic missile programs. As part of their larger “RustBucket” malware campaign, BlueNoroff’s current financially motivated attacks have targeted cryptocurrency exchanges, venture capital firms, and banks with a starkly simplistic new malware called “ObjCShellz”. The initial access vector is currently unknown; however, it is presumed the malware is delivered through social engineering attacks where attackers disguise themselves as potential partners, investors, or headhunters, which is common in the RustBucket campaign. The malware was not initially present on VirusTotal, but later had submissions in September and October of 2023 originating from Japan and the United States. A domain in the code appears to be linked to a cryptocurrency company, showing communication with a typosquat domain of the cryptocurrency exchange “swissborg[.]com/blog”. This is common practice for the threat actor based on the patterns of previous attacks where the attacker creates a domain looking to be a legitimate crypto or financial company to blend in with network activity. CTIX analysts will stay up to date with relevant updates concerning this campaign.