Forensia CTI Core

Profile

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.

MITRE ATT&CK ↗

Techniques

30 ATT&CK techniques attributed to this actor.

T1003.001 LSASS Memory T1016 System Network Configuration Discovery T1027 Obfuscated Files or Information T1027.009 Embedded Payloads T1027.013 Encrypted/Encoded File T1033 System Owner/User Discovery T1053.005 Scheduled Task T1071.001 Web Protocols T1082 System Information Discovery T1105 Ingress Tool Transfer T1140 Deobfuscate/Decode Files or Information T1195.002 Compromise Software Supply Chain T1204.002 Malicious File T1217 Browser Information Discovery T1486 Data Encrypted for Impact T1547.001 Registry Run Keys / Startup Folder T1566.001 Spearphishing Attachment T1566.003 Spearphishing via Service T1569.002 Service Execution T1583.001 Domains T1583.003 Virtual Private Server T1585.001 Social Media Accounts T1585.002 Email Accounts T1587 Develop Capabilities T1587.001 Malware T1589.002 Email Addresses T1591 Gather Victim Org Information T1598 Phishing for Information T1598.003 Spearphishing Link T1608.001 Upload Malware

Software

1 malware/tools attributed to this actor.

Qilin

Related corpus activity

10,406 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Moonstone Sleet.

Indicator	Type	Family	Sev	Src
cve-2023-44976	cve	ransomware	85	2
cve-2026-1969	cve	—	85	1
cve-2025-68670	cve	—	85	2
cve-2026-3102	cve	—	85	3
cve-2025-2492	cve	—	85	2
cve-2021-29441	cve	—	85	1
cve-2026-22584	cve	—	85	2
cve-2025-11837	cve	—	85	2
cve-2025-34054	cve	—	85	4
cve-2014-2321	cve	—	85	1
cve-2020-17456	cve	—	85	1
cve-2020-22658	cve	—	85	2
cve-2017-18377	cve	—	85	1
cve-2021-25646	cve	—	85	1
cve-2025-66478	cve	—	85	2
cve-2025-0921	cve	—	85	2
cve-2021-27076	cve	—	85	1
cve-2013-3307	cve	—	85	2
cve-2016-5681	cve	—	85	2
cve-2016-15047	cve	—	85	4
cve-2024-1781	cve	—	85	1
cve-2018-8007	cve	—	85	1
cve-2025-23304	cve	—	85	2
cve-2021-4045	cve	—	85	1
cve-2020-22653	cve	—	85	2
cve-2022-47945	cve	—	85	1
cve-2025-34117	cve	—	85	1
cve-2026-4368	cve	ransomware	85	1
cve-2013-7471	cve	—	85	1
cve-2026-0740	cve	—	85	1

Showing the top 30 by severity of 10,406.