Update (October 27, 2026): The Drift Protocol section was revised after Drift said in June that Mandiant’s forensic investigation attributed the April attack to UNC6862, a separate North Korean group, rather than UNC4736. The profile also now covers CISA’s AppleJeus advisory. No new operations have been publicly attributed to UNC4736 in the last 90 days.
Aliases: Citrine Sleet (Microsoft), AppleJeus (CISA and MITRE ATT&CK), Golden Chollima (CrowdStrike), Gleaming Pisces (Palo Alto Networks Unit 42)
Type: State-sponsored, financially motivated threat group
Attribution: North Korea (DPRK), assessed as part of the broader Lazarus Group ecosystem
First observed: 2018
Primary operations: Cryptocurrency theft, social engineering, trojanized applications, software supply chain compromise, browser zero-day exploitation
Primary targets: Cryptocurrency exchanges, DeFi protocols, fintech and trading firms, and individuals who manage digital assets
Status as of October 27, 2026: Active threat, with no new publicly attributed operations in the last 90 days and the Drift Protocol attribution revised
UNC4736 is a North Korean state-sponsored threat group focused on stealing cryptocurrency to generate revenue for the regime. Mandiant tracks it as UNC4736, and it overlaps with clusters other vendors call Citrine Sleet, AppleJeus, Golden Chollima and Gleaming Pisces.
The group is best known for the 2023 3CX double supply chain compromise and the $53 million Radiant Capital theft in 2024. It was initially linked to the $285 million Drift Protocol theft in April 2026, but Drift later said Mandiant attributed that attack to a different North Korean group.
Latest UNC4736 activity
This timeline covers the last 90 days of developments, including confirmed incidents, law enforcement actions and unverified extortion claims. Earlier events are listed in the coverage archive below.
No new operations have been publicly attributed to UNC4736 in the last 90 days. The most recent significant development came in Drift Protocol’s June 3, 2026 recovery update, which said Mandiant’s investigation “conclusively attributed” the April attack to UNC6862, a North Korean threat group with ties to other state-sponsored actors.
Origins and evolution
UNC4736’s mission is financial. Unlike North Korean espionage groups that target governments and defense contractors, it focuses on cryptocurrency platforms, DeFi protocols, trading firms and people who manage digital assets.
In 2021, CISA, the FBI and the Treasury Department published a joint advisory on AppleJeus, malware hidden in trojanized cryptocurrency trading applications. The agencies said the North Korean actors behind it targeted organizations in more than 30 countries. AppleJeus has been linked to more than one North Korean cluster over time, and the boundaries between UNC4736 and related groups are not always clear.
How UNC4736 operates
The group relies on long-running social engineering. It builds convincing personas, including fake trading firms, recruiters and wallet developers, and uses them to build relationships with targets before delivering a trojanized application, malicious code repository or weaponized file.
Once a target runs the malicious file, the group deploys malware to steal credentials and private keys and keep access. Known malware families include:
- AppleJeus: Trojanized trading and wallet applications that collect the information needed to steal cryptocurrency
- VEILEDSIGNAL: A modular backdoor used in the X_TRADER and 3CX operation
- POOLRAT: A backdoor for macOS and Linux identified in the 3CX investigation
- INLETDRIFT: A macOS backdoor used in the Radiant Capital theft
- FudModule: A rootkit also used by other North Korean clusters
In August 2024, Microsoft reported that Citrine Sleet exploited CVE-2024-7971, a Chromium zero-day, and then used CVE-2024-38106 in the Windows kernel to load FudModule.
Notable incidents
3CX supply chain compromise (2022 to 2023): The group compromised the website of Trading Technologies and planted VEILEDSIGNAL in the installer for X_TRADER, a retired trading application. A 3CX employee installed it in 2022, giving the attackers a path into 3CX’s build environments and its DesktopApp. Mandiant attributed the operation to UNC4736 with moderate confidence in April 2023, calling it the first publicly reported cascading software supply chain attack.
Radiant Capital (October 2024): A Radiant developer received a Telegram message from someone posing as a former contractor, with a ZIP file that delivered INLETDRIFT. The attackers compromised several multisig signers and, on October 16, 2024, drained about $53 million. Radiant said Mandiant attributed the attack to UNC4736 with high confidence.
Drift Protocol (April 2026): Attackers posing as a trading firm spent about 6 months building relationships with Drift contributors before draining about $285 million on April 1, 2026. The SEAL 911 team initially attributed the attack to UNC4736 with medium-high confidence. Drift’s June update said Mandiant attributed it to UNC6862. BreachNews now treats Drift as North Korean activity that is not confirmed as UNC4736.
Law enforcement actions
U.S. agencies have documented AppleJeus since at least 2021 through the joint CISA, FBI and Treasury advisory. No arrests or new government actions specific to UNC4736 have been publicly reported in 2026. North Korean operators are generally out of reach of Western law enforcement, so responses focus on advisories, sanctions and tracing or freezing stolen funds.
Defensive takeaways
- Verify new business contacts, investors and contractors through independent channels, even after in-person meetings.
- Never run files, apps or code repositories shared through Telegram, conferences or job offers on devices with access to wallets or signing keys.
- Use dedicated, locked-down devices for multisig signers and verify transaction details on hardware wallets.
- Patch browsers and operating systems quickly, since the group has used zero-day chains.
- Monitor software update channels and build environments for tampering.
All UNC4736 coverage
The following archive contains BreachNews reporting related to UNC4736, from the latest developments backward. Our guide to social engineering in the workplace explains how to spot the techniques the group uses.
Current threat assessment
As of October 27, 2026, UNC4736 remains a serious threat to cryptocurrency and DeFi organizations, even though no new operations have been publicly attributed to it in the last 90 days. North Korean groups have invested heavily in patient, relationship-based social engineering, and similar tactics are now used by several overlapping clusters.
The Drift attribution change shows how difficult it can be to separate North Korean groups that share tools, tactics and laundering infrastructure. Defenders should focus on the techniques rather than any one group name.
Attribution and verification
UNC4736’s link to 3CX comes from Mandiant at moderate confidence, and its link to Radiant Capital comes from Radiant’s account of Mandiant’s findings. The initial UNC4736 attribution for Drift came from SEAL 911 and was later superseded by Drift’s report of Mandiant’s UNC6862 finding. Vendor aliases describe overlapping, not always identical, activity. Everything on this page is alleged unless an affected organization or authority has confirmed it.
Sources and advisories
- Drift Protocol recovery update (June 3, 2026)
- Mandiant: 3CX software supply chain compromise (April 2023)
- Radiant Capital incident update (December 2024)
- Microsoft: North Korean threat actor Citrine Sleet exploiting Chromium zero-day (August 30, 2024)
- CISA, FBI and Treasury: AppleJeus analysis of North Korea’s cryptocurrency malware (AA21-048A)
- MITRE ATT&CK: AppleJeus (G1049)
Changelog
- October 27, 2026: Revised the Drift Protocol attribution, added a fact box, the CISA advisory, law enforcement actions, defensive takeaways and sources, and removed unsourced claims.
- April 10, 2026: Profile published.
