Elastic reports an active DPRK/REF9135 campaign using a newly observed RUSTBUCKET macOS variant against a cryptocurrency payment services provider. The malware family, previously attributed to BlueNorOff, had added built-in persistence and reduced signature detection; the newly found sample was undetected by VirusTotal engines at publication. The infection chain uses AppleScript and curl to retrieve a Swift Stage 2 payload from C2, then runs a Rust FAT Stage 3 binary that collects process and system information, posts it to C2, and can download and execute Mach-O binaries or shell scripts. Elastic attributes the observed intrusions with high confidence to Lazarus Group/DPRK based on host, binary, network, victimology, and infrastructure overlaps.