Unpacking Bluenoroff’s RustBucket Campaign

**Executive summary:** Sekoia.io documents Bluenoroff (a North Korea–nexus intrusion set) using a cross-platform RustBucket backdoor—including a macOS fake PDF reader and a Windows .NET variant—to target finance and cryptocurrency-related organizations, detailing infection chains, payload behavior, network infrastructure, YARA rules and extensive IOCs (hashes, domains, IPs).