Moonstone Sleet

Overview

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.

Targets

Government · Private sector

Regions

Australia · Bangladesh · Bangladesh Bank · Brazil · Canada · China · Cryptocurrency exchanges in South Korea · France · Germany · Guatemala · Hong Kong · India · Japan · Sony Pictures Entertainment · South Korea · Thailand · United Kingdom · United States

Capabilities

• Supply-chain compromise — ATT&CK T1195.002

TTPs — 30 techniques across 10 tactics

Tools & malware (1)

Qilin

Reporting (1)

• Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks — Microsoft Threat Intelligence