moonstone-sleet

Definition

**Moonstone Sleet** is a **North Korea–aligned advanced persistent threat (APT)** group first publicly identified by [Microsoft](https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/) in May 2024, initially tracked as *Storm-1789*. The group blends **cyber espionage** with **financially motivated ransomware attacks**, targeting sectors such as **software development**, **education**, **aerospace**, and **defense**.

Moonstone Sleet’s tactics involve **fake personas**, **malicious software packages**, **trojanized applications**, and **custom ransomware**, as well as the use of third-party Ransomware-as-a-Service (RaaS) platforms.

## Tactics, Techniques, and Procedures (TTPs)

### 1. **Fake Personas and Social Engineering**

Moonstone Sleet sets up **fake companies**—such as *StarGlow Ventures* and *C.C. Waterfall*—with corresponding websites, social media accounts, and professional profiles. These personas are used to approach targets under the guise of **job offers** or **collaborative project opportunities**.
📄 *Source*: [Microsoft](https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/)

### 2. **Trojanized Software and Multi-Stage Loaders**

The group distributes trojanized versions of legitimate tools, such as **PuTTY**, via **LinkedIn**, **Telegram**, and freelance job boards. These tools decrypt and execute **SplitLoader** and **YouieLoader** to establish persistence and deliver follow-on payloads.
📄 *Source*: [Microsoft](https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/)

### 3. **Use of Open-Source Ecosystems**

Moonstone Sleet has published **malicious npm packages**—including *harthat-api* and *harthat-hash*—to deliver malware to developers. These packages fetch secondary payloads via command-and-control (C2) infrastructure.
📄 *Source*: [Datadog Security Labs](https://securitylabs.datadoghq.com/articles/stressed-pungsan-dprk-aligned-threat-actor-leverages-npm-for-initial-access/)

### 4. **Malicious Games**

In early 2024, the group released a fully functional but malicious blockchain-themed game called **DeTankWar** (*aka DeFiTankWar, TankWarsZone*). Promoted through fake blockchain developer profiles, the game required account registration and secretly delivered malware to players.
📄 *Source*: [Anvilogic](https://www.anvilogic.com/threat-reports/moonstone-sleet-fakepenny)

### 5. **Custom Ransomware – FakePenny**

In April 2024, Moonstone Sleet deployed a custom ransomware variant named **FakePenny** against an aerospace/defense target, demanding **\$6.6 million in Bitcoin**. The incident exemplified the group’s **dual-purpose operations**: espionage and high-value financial extortion.
📄 *Source*: [Microsoft](https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/)

### 6. **Shift to RaaS: Qilin**

By February 2025, Moonstone Sleet began deploying **Qilin ransomware**, a known Ransomware-as-a-Service (RaaS) platform, marking a shift from their own ransomware development to outsourcing encryption operations while focusing on intrusion and delivery.
📄 *Source*: [Field Effect](https://fieldeffect.com/blog/moonstone-sleet-shifts-tactics-deploys-qilin-ransomware/)

## Relationship to Other DPRK Threat Actors

While Moonstone Sleet initially shared code and infrastructure with **Diamond Sleet** (linked to the Lazarus Group), it has evolved into a **standalone actor** with **unique infrastructure** and **parallel campaigns**.
📄 *Source*: [Microsoft](https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/)

## Summary Table

| Feature                 | Details                                                              |
| ----------------------- | -------------------------------------------------------------------- |
| **Affiliation**         | North Korea–aligned (DPRK)                                           |
| **Primary Targets**     | IT, education, aerospace, defense                                    |
| **Initial Access**      | Fake personas, malicious packages, trojanized tools, malicious games |
| **Payloads**            | Custom ransomware (*FakePenny*), Qilin RaaS                          |
| **Notable Techniques**  | Social engineering, multi-stage loaders, supply chain compromise     |
| **First Public Report** | May 2024 (Microsoft)                                                 |

Related Terms

Examples & Use Cases

Practice in These Games

Titan Shield: A showcase of Microsoft Defender XDR

Welcome to TitanShield! TitanShield is a world-class defense company best known for manufacturing to keep the world safe 🦅 Recently, TitanShield has noticed some unusual activity on their network🧐....

View Game

Moonstone-Sleet

Definition

Related Terms

Examples & Use Cases

Practice in These Games

Titan Shield: A showcase of Microsoft Defender XDR