Moonstone Sleet
Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.
- ATT&CK ID
- G1036
- Origin
- North Korea
- Weather family
- Sleet
- Techniques
- 23
- Tools
- 1
Also tracked as Storm-1789
Techniques
Reconnaissance
Gather Victim Identity InformationGather Victim Org InformationPhishing for Information
Resource Development
Acquire InfrastructureEstablish AccountsDevelop CapabilitiesStage Capabilities
Initial Access
Supply Chain CompromisePhishing
Execution
Scheduled Task/JobUser ExecutionSystem Services
Persistence
Scheduled Task/JobBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationDeobfuscate/Decode Files or Information
Credential Access
Discovery
System Network Configuration DiscoverySystem Owner/User DiscoverySystem Information DiscoveryBrowser Information Discovery
Command and Control
Application Layer ProtocolIngress Tool Transfer
Impact
Software
Qilin