Skip to content
skopnix
← Adversaries

File · Moonstone Sleet · Unknown · refreshed 2026-10-18

Moonstone Sleet

  • Storm-1789

MITRE G1036 ↗

Moonstone Sleet — ATT&CK roseMS

attack rose · 30 techniques across 10 tactics

Analyst brief

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

30 techniques · 10 of 15 tactics

  1. Reconnaissance

    4 techniques

  2. Resource development

    7 techniques

  3. Initial access

    3 techniques

  4. Execution

    3 techniques

  5. Persistence

    1 technique

  6. Stealth

    4 techniques

  7. Credential access

    1 technique

  8. Discovery

    4 techniques

  9. Command and control

    2 techniques

  10. Impact

    1 technique

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
QilinS1242 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Detections

6 rules · Sigma · QRadar · Cortex

  1. Behaviour (ATT&CK technique)

    LSASS memory dump via comsvcs.dll MiniDump (T1003.001)

    APT1 · APT15 · APT27 · APT28 · APT3 · APT32 · 39 more

    T1003.001conf 90SIGAQLXQL

  2. Behaviour (ATT&CK technique)

    certutil used to download a remote file (T1105)

    APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 85 more

    T1105conf 80SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

2 sources
  1. 1.attack.mitre.org/groups/G1036
  2. 2.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges…

Track Moonstone Sleet on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.