MITRE ATT&CKgroup
G1036 Moonstone Sleet
- Domain
- enterprise
- Aliases
- Storm-1789
- Version
- 1.0
- Created
- 2024-08-26
Description
Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.
Related
Uses · MITRE ATT&CK (31)
- S1242 Qilin software (malware)
- T1027.013 Encrypted/Encoded File sub-technique
- T1027.009 Embedded Payloads sub-technique
- T1608.001 Upload Malware sub-technique
- T1589.002 Email Addresses sub-technique
- T1591 Gather Victim Org Information technique
- T1598 Phishing for Information technique
- T1598.003 Spearphishing Link sub-technique
- T1583.003 Virtual Private Server sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1585.002 Email Accounts sub-technique
- T1587 Develop Capabilities technique
- T1587.001 Malware sub-technique
- T1583.001 Domains sub-technique
- T1071.001 Web Protocols sub-technique
- T1195.002 Compromise Software Supply Chain sub-technique
- T1204.002 Malicious File sub-technique
- T1569.002 Service Execution sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.003 Spearphishing via Service sub-technique
- T1003.001 LSASS Memory sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1053.005 Scheduled Task sub-technique
- T1486 Data Encrypted for Impact technique
- T1217 Browser Information Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1016 System Network Configuration Discovery technique
- T1027 Obfuscated Files or Information technique
- T1033 System Owner/User Discovery technique
- T1082 System Information Discovery technique