Moonstone Sleet

Threat Actor
4 incidents First seen 2026-02-24 Last seen 2026-10-28
Overview

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 170 33 techniques 1 tools & malware in ATT&CK since 2024-08-26 updated 2026-07-31 · v1.0
Activity by month (incidents)
2026-022026-10
Sectors targeted
health · 3cryptocurrency · 1defense · 1education · 1finance · 1government · 1manufacturing · 1
Countries targeted
RU · 2AE · 1BH · 1CA · 1CN · 1GB · 1IE · 1IL · 1IQ · 1IR · 1JO · 1JP · 1
Origin
US · 2AO · 1BF · 1BI · 1BJ · 1BW · 1
Kinds of incident
Data Breach · 2Ransomware & Extortion · 2State-Sponsored & Espionage · 2Critical Infrastructure & OT · 1
Techniques seen in incidents
Ransomware · 4Extortion · 3Espionage · 1Phishing · 1Reconnaissance · 1
Related malware
Qilin · 4BLINDINGCAN · 1Medusa Ransomware · 1WannaCry · 1
ATT&CK techniques by tactic (33)
reconnaissance T1589.002 Email Addresses T1591 Gather Victim Org Information T1598 Phishing for Information T1598.003 Spearphishing Link
resource development T1583.001 Domains T1583.003 Virtual Private Server T1585.001 Social Media Accounts T1585.002 Email Accounts T1587 Develop Capabilities T1587.001 Malware T1608.001 Upload Malware
initial access T1195.002 Compromise Software Supply Chain T1566.001 Spearphishing Attachment T1566.003 Spearphishing via Service
execution T1053.005 Scheduled Task T1204.002 Malicious File T1569.002 Service Execution
persistence T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder
privilege escalation T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder
credential access T1003.001 LSASS Memory
discovery T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1082 System Information Discovery T1217 Browser Information Discovery
command and control T1071.001 Web Protocols T1105 Ingress Tool Transfer
impact T1486 Data Encrypted for Impact
stealth T1027 Obfuscated Files or Information T1027.009 Embedded Payloads T1027.013 Encrypted/Encoded File T1140 Deobfuscate/Decode Files or Information
Tools & malware it uses
Qilin
Incident timeline
2026-10-28
AlienVault OTX
2026-09-07
North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters
Infosecurity-Magazine
2026-08-28
CyberScoop
2026-02-24
The Register - Cybercrime Data Breaches The Hacker News