Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.1
- Microsoft Moonstone Sleet 2024
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1587.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1217 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.009 | 2024 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1016 | System Network Configuration Discovery | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.009 | Embedded Payloads | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1033 | System Owner/User Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1071.001 | Web Protocols | — |
| T1082 | System Information Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1204.002 | Malicious File | — |
| T1217 | Browser Information Discovery | — |
| T1486 | Data Encrypted for Impact | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.003 | Spearphishing via Service | — |
| T1569.002 | Service Execution | — |
| T1583.001 | Domains | — |
| T1583.003 | Virtual Private Server | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1587 | Develop Capabilities | — |
| T1587.001 | Malware | — |
| T1589.002 | Email Addresses | — |
| T1591 | Gather Victim Org Information | — |
| T1598 | Phishing for Information | — |
| T1598.003 | Spearphishing Link | — |
| T1608.001 | Upload Malware | — |
Aliases
Moonstone Sleet · Storm-1789
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.