RustBucket is a remote access trojan. Trojans are often focused on espionage capabilities rather than monetary gain, but some overlap may occur depending on attacker objectives. They generally include multiple different functionalities such as remote shell capabilities, keyloggers, infostealers and more.

RustBucket, employed by the APT group BlueNoroff—a North Korean subgroup of the well-known Lazarus Group—is a multi-stage malware targeting users via intricate social engineering campaigns. The initial droppers are written in Objective-C, Swift, and AppleScript, while the final payload is crafted in Rust. In typical campaigns, the malware disguises itself as a benign PDF reader. Users are convinced to open a specific PDF document using this rogue application, triggering a callback to the attacker's Command and Control server. Read more on this campaign at the Jamf link below.