Citrine Sleet
aka AppleJeus, UNC4736, Gleaming Pisces, UNC1720
A North Korean group tied to the Reconnaissance General Bureau that targets the crypto industry. It gets in through fake trading apps and booby-trapped sites that exploit unknown browser flaws.
- Alert level
- 2/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 2
- Personal data leaked (disclosed)
- None confirmed
Attribution
- North Korean state-sponsored group attributed to the Reconnaissance General Bureau — MITRE ATT&CK
- Attributed Chromium zero-day exploitation to North Korean actor Citrine Sleet — Microsoft
Exploited vulnerabilities and targeted products
If you run any of these products, first make sure they are updated to a fixed version.
How they attack
Entry
Luring to a booby-trapped site
Like inviting someone to a showroom whose floor has a trapdoor that catches them the moment they step in.
Inside
Hiding deep in the operating system
Like rewiring the security cameras so they never show the intruder.
Goal
Stealing cryptocurrency
Like taking over the vault keeper's computer and opening the vault while pretending to be them.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily