Moonstone Sleet

Summary

North Korean state actor (MITRE G1036; Microsoft, formerly Storm-1789) running both revenue and espionage operations. It overlapped heavily with Lazarus/Diamond Sleet early on but has used its own tooling and infrastructure since 2023. Signature tradecraft is fake companies (C.C. Waterfall, StarGlow Ventures, software-development and IT-services fronts) used to approach targets over LinkedIn, freelancing sites, Telegram and email, delivering trojanized PuTTY (from Aug 2023), malicious npm packages and a fully working malicious tank game, DeTankWar (from Feb 2024). In April 2024 it deployed its own FakePenny ransomware with a $6.6M demand; from late February 2025 Microsoft saw it deploy Qilin ransomware at a limited number of organisations — its first use of a RaaS operator's payload.

Attribution

No bureau publicly named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Microsoft, via BleepingComputer (Research, 2025-03-07)
  A North Korean state actor
• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  North Korean-linked

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 10

Malware and tools 4

Infrastructure patterns

• Own infrastructure, apart from Diamond Sleet's; VPSs host payloads fetched with curl (Microsoft, 2024; MITRE ATT&CK, 2026)

Reporting and advisories 3

• Microsoft Threat Intelligence
  Moonstone Sleet emerges as new North Korean threat actor
• MITRE ATT&CK
  Moonstone Sleet (G1036)
• BleepingComputer
  Microsoft: North Korean hackers now deploying Qilin ransomware