Lazarus_Group__2018__Operation_AppleJeus.pdf

### Executive summary Kaspersky describes Operation "AppleJeus": a supply-chain campaign attributed to the Lazarus APT that trojanized a seemingly legitimate cryptocurrency trading app (Celas Trade Pro) to push Windows and macOS updaters which exfiltrate system info and fetch RC4-encrypted payloads (Fallchill and additional backdoors); the report includes in-depth malware analysis, persistence and loader mechanics, RC4 keys, extensive IOCs (hashes, file paths, domains, IPs), and infrastructure/WHOIS evidence linking the campaign to known Lazarus infrastructure.