The DPRK strikes using a new variant of RUSTBUCKET

Elastic Security Labs reports a newly observed, undetected variant of the RUSTBUCKET macOS malware used by REF9135 (attributed to Lazarus/BlueNorOff) against a venture-backed cryptocurrency payment provider; the report details a three-stage infection flow, a new LaunchAgent persistence mechanism, dynamic C2 infrastructure and IoCs, defense-evasion techniques (including strict User-Agent checks), and provides detection and prevention guidance (Elastic Defend rules and YARA).