Record · corpus.blog/posts/01a0d4b5-15c5-72fb-9ccc-532d8d6b0add

RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector

Unit 42 · published 26 February 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at unit42.paloaltonetworks.com Wayback capture

2blogs citing

First cited: 17 Dec 2025
Most recent: 1 Jan 2026
Rank this month: not ranked
Links from this post: 30
Words captured: 3,016

Cited by

Blog

In the post

Date

objective-see.org

The Mac Malware of 2025 Read at the source ↗

1 Jan 2026

oliviagallucci.com

EDR Evasion with Lesser-Known Languages & macOS APIs Read at the source ↗

17 Dec 2025

Links from this post

Link

Host

https://www.ic3.gov/PSA/2024/PSA240903

ic3.gov

https://www.bleepingcomputer.com/news/security/new-rustdoor-macos-malware-impersonates-visual-studio-update/

bleepingcomputer.com

https://malpedia.caad.fkie.fraunhofer.de/details/win.koistealer

malpedia.caad.fkie.fraunhofer.de

https://unit42.paloaltonetworks.com/tag/contagious-interview/

unit42.paloaltonetworks.com

https://www.paloaltonetworks.com/cortex/cortex-xdr

paloaltonetworks.com

https://docs-cortex.paloaltonetworks.com/p/XSIAM

docs-cortex.paloaltonetworks.com

https://docs.paloaltonetworks.com/cdss

docs.paloaltonetworks.com

https://docs.paloaltonetworks.com/ngfw

docs.paloaltonetworks.com

https://docs.paloaltonetworks.com/advanced-wildfire

docs.paloaltonetworks.com

https://www.paloaltonetworks.com/network-security/dns-security

paloaltonetworks.com

https://www.paloaltonetworks.com/network-security/advanced-url-filtering

paloaltonetworks.com

https://start.paloaltonetworks.com/contact-unit42.html

start.paloaltonetworks.com

https://unit42.paloaltonetworks.com/tag/macos/

unit42.paloaltonetworks.com

https://unit42.paloaltonetworks.com/tag/infostealer/

unit42.paloaltonetworks.com

https://unit42.paloaltonetworks.com/tag/rust/

unit42.paloaltonetworks.com

Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors Read at the source ↗

unit42.paloaltonetworks.com

Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware Read at the source ↗

unit42.paloaltonetworks.com

https://www.jamf.com/blog/jamf-threat-labs-observes-targeted-attacks-amid-fbi-warnings/

jamf.com

https://developer.apple.com/library/archive/documentation/Performance/Conceptual/CodeFootprint/Articles/MachOOverview.html

developer.apple.com

https://unit42.paloaltonetworks.com/tag/redline-infostealer/

unit42.paloaltonetworks.com

https://www.secrss.com/articles/73274

secrss.com

https://en.wikipedia.org/wiki/Universally_unique_identifier

en.wikipedia.org

https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1

medium.com

https://thehackernews.com/2024/02/rustdoor-macos-backdoor-targets.html

thehackernews.com

https://www.sentinelone.com/labs/bluenoroff-hidden-risk-threat-actor-targets-macs-with-fake-crypto-news-and-novel-persistence/

sentinelone.com

https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention

paloaltonetworks.com

https://www.cyberthreatalliance.org/

cyberthreatalliance.org

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Analytics-Alert-Reference-by-data-source/Unusual-process-accessed-web-browser-credentials

docs-cortex.paloaltonetworks.com

https://www.bitdefender.com/en-us/blog/labs/new-macos-backdoor-written-in-rust-shows-possible-link-with-windows-ransomware-group

bitdefender.com

https://medium.com/s2wblog/rustdoor-and-gatedoor-a-new-pair-of-weapons-disguised-as-legitimate-software-by-suspected-34c94e558b40

medium.com