Moonstone Sleet

Origin🇰🇵 Coreia do Norte

Techniques (MITRE ATT&CK)30

SourceMITRE ATT&CK

State sponsor: Korea (Democratic People's Republic of)Attribution confidence: 50%Target categories: Government, Private sector

Targeted regions: South Korea · Bangladesh Bank · Sony Pictures Entertainment · United States · Thailand · France · China · Hong Kong · United Kingdom · Guatemala +9

Also known as:APT 38APT-C-26APT38ATK117ATK3AndarielApplewormBeagleBoyzBlack ArtemisBluenoroffBureau 121COPERNICIUMCOVELLITECitrine SleetDEV-0139DEV-1222Dark SeoulDiamond SleetG0032G0082Group 77Hastati GroupHidden CobraLabyrinth ChollimaLazarus groupNICKEL GLADSTONENewRomanic Cyber Army TeamNickel AcademyOperation AppleJeusOperation DarkSeoulOperation GhostSecretOperation TroySapphire SleetStardust ChollimaStorm-1789Subgroup: BluenoroffTA404Unit 121Whois Hacking TeamZINCZinc

About the group

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity41

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 30

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Email Addresses Gather Victim Org Information Phishing for Information Spearphishing Link

Resource development

Domains Virtual Private Server Social Media Accounts Email Accounts Develop Capabilities Malware Upload Malware

Initial access

Compromise Software Supply Chain Spearphishing Attachment Spearphishing via Service

Execution

Scheduled Task Malicious File Service Execution

Persistence

Registry Run Keys / Startup Folder

Credential access

LSASS Memory

Discovery

System Network Configuration Discovery System Owner/User Discovery System Information Discovery Browser Information Discovery

Command and control

Web Protocols Ingress Tool Transfer

Impact

Data Encrypted for Impact

stealth

Obfuscated Files or Information Embedded Payloads Encrypted/Encoded File Deobfuscate/Decode Files or Information

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Known infrastructure 4

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

md5_hashe94148c2688de4f86df961d7ee2e8b18Qilinthreatfox

md5_hash2178e0b2e5c6058b6e39486249292f5fQilinthreatfox

md5_hash4ca3438f72d0ee6fc2c0c572db9fa866Qilinthreatfox

md5_hash687483f9b58e995b87af9ab3590333edQilinthreatfox

References

Moonstone Sleet uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →