Introduction
Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game. Microsoft Moonstone Sleet 2024
Activities and Tactics
Country of Origin: 🇰🇵 North Korea
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1587.001 Malware
- T1033 System Owner/User Discovery
- T1071.001 Web Protocols
- T1585.002 Email Accounts
- T1589.002 Email Addresses
- T1140 Deobfuscate/Decode Files or Information
- T1591 Gather Victim Org Information
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1204.002 Malicious File
- T1566.001 Spearphishing Attachment
- T1027 Obfuscated Files or Information
- T1583.003 Virtual Private Server
- T1105 Ingress Tool Transfer
- T1016 System Network Configuration Discovery
- T1598.003 Spearphishing Link
- T1003.001 LSASS Memory
- T1608.001 Upload Malware
- T1598 Phishing for Information
- T1195.002 Compromise Software Supply Chain
- T1569.002 Service Execution
- T1583.001 Domains
- T1217 Browser Information Discovery
- T1566.003 Spearphishing via Service
- T1486 Data Encrypted for Impact
- T1585.001 Social Media Accounts
- T1587 Develop Capabilities
- T1082 System Information Discovery
- T1027.013 Encrypted/Encoded File
- T1027.009 Embedded Payloads
ATT&CK technique IDs (denormalized)
- T1003.001
- T1016
- T1027
- T1027.009
- T1027.013
- T1033
- T1053.005
- T1071.001
- T1082
- T1105
- T1140
- T1195.002
- T1204.002
- T1217
- T1486
- T1547.001
- T1566.001
- T1566.003
- T1569.002
- T1583.001
- T1583.003
- T1585.001
- T1585.002
- T1587
- T1587.001
- T1589.002
- T1591
- T1598
- T1598.003
- T1608.001
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- CyberGate:
- Cyber Eye RAT:
MITRE ATT&CK Software
Attribution and Evidence
Country of Origin: North Korea Additional attribution information pending cataloguing.
References
[1] mitre-attack [3] Microsoft Moonstone Sleet 2024 Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.