- Category
- State · Attributed to a state or working for one.
- Origin
- North Korea(high confidence)
- Agency named
- Lazarus
- Motivation
- Financial gain; Information theft and espionage
- Seen
- 2023–2026
- Status
- Active
- ATT&CK
- G1036 · 30 techniques
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0314 · moonstone-sleet
North KoreaWhat it is
Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- LABYRINTH CHOLLIMA
- Microsoft
- Storm-1789
- Other names
- Stressed Pungsan
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTNorth Korea
- MicrosoftNorth Korea
- ThreatActor.info (Malpedia et al.)North Korea · high
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- Qilin
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th