FlagThis

← All Threat Actors
Threat Actor Profile

Moonstone Sleet

G1036 Storm-1789 Stressed Pungsan
▲ High Threat
[Moonstone Sleet](https://attack.mitre.org/groups/G1036) is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, [Lazarus Group](https://attack.mitre.org/groups/G0032), but has differentiated its tradecraft since 2023. [Moonstone Sleet](https://attack.mitre.org/groups/G1036) is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.(Citation: Microsoft Moonstone Sleet 2024)
Origin —

Known TTPs

Malware
System Owner/User Discovery
Web Protocols
Email Accounts
Email Addresses
Deobfuscate/Decode Files or Information
Gather Victim Org Information
Scheduled Task
Registry Run Keys / Startup Folder
Malicious File
Spearphishing Attachment
Obfuscated Files or Information
Virtual Private Server
Ingress Tool Transfer
System Network Configuration Discovery
Spearphishing Link
LSASS Memory
Upload Malware
Phishing for Information
Compromise Software Supply Chain
Service Execution
Domains
Browser Information Discovery
Spearphishing via Service
Data Encrypted for Impact
Social Media Accounts
Develop Capabilities
System Information Discovery
Encrypted/Encoded File
Embedded Payloads

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD