UNC4736
Attribution profile
- Type
- Nation State
- Location
- North Korea
- Known incidents
- 3 incidents
- Sources
- 7 sources
- First seen
- 2016-01-18
- Last seen
- 2024-10-16
- Updated
- 2026-10-13 06:52
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
UNC4736 is a North Korea‑aligned threat actor also tracked as UNC4736 and linked to the Reconnaissance General Bureau; it is financially motivated and associated with the Lazarus Group behind Operation AppleJeus as well as with APT43 clusters UNC3782 and UNC4469. The actor targets financial and cryptocurrency services as well as software supply chains, seeking to steal funds and credentials while establishing persistent backdoors for remote access. Its tactics include delivering malicious ZIP files via Telegram that deploy the INLETDRIFT macOS backdoor alongside a decoy PDF, using trojanized trading software (X_TRADER) to harvest credentials and push the VEILEDSIGNAL modular backdoor, compromising build environments with stolen credentials to install the TAXHAUL launcher and COLDCAT downloader via DLL hijacking of the IKEEXT service on Windows and the POOLRAT backdoor via LaunchDaemons on macOS, achieving persistence through DLL side‑loading of legitimate Windows binaries, manipulating front‑end interfaces and staging malicious smart contracts across multiple blockchain networks to conceal transactions during signing, and employing supply‑chain compromises to distribute trojanized 3CX desktop clients that deploy backdoors granting attackers remote internet access. Notable publicly reported operations are the October 2024 Radiant Capital attack that resulted in a $50 million loss and the March 2023 3CX supply‑chain incident that led to trojanized Windows and macOS clients being distributed to users.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 7 sources.