Moonstone Sleet

Executive Summary

Moonstone Sleet is a North Korean‑linked threat actor that blends financial exploitation—primarily via Qilin ransomware—with sophisticated espionage and social engineering operations. The group has adopted game‑based malware delivery and forged personas to bypass defenses, leveraging scheduled tasks, registry run keys, and trojanized applications for persistence and initial compromise. Recent activity demonstrates a clear shift away from Lazarus Group tradecraft toward more diversified tactics, increasing both impact and covert data collection.

Goals & Targeting

Moonstone Sleet seeks to maximize value from high‑profile corporate and government targets across the world, focusing on sectors that provide both lucrative financial payoff and sensitive intelligence. By creating sophisticated fake companies, exploiting social media spearphishing vectors, and utilizing embedded game delivery mechanisms, the group reduces discovery risk while widening its attack surface. The dual emphasis on ransomware payout and data exfiltration suggests a long‑term objective of funding state assets through illicit funds coupled with clandestine information gains tailored to North Korean strategic interests.

Key Capabilities

• Obfuscated and encoded payload delivery
• Deployment of Qilin ransomware for financial exploitation
• Espionage operations across government, finance, defense, critical infrastructure sectors
• Social engineering using fake companies and personas
• Game‑based malware delivery via a legitimate gaming application
• Spearphishing through social media platforms
• Registry run key persistence
• Scheduled task execution for initial access and persistence
• Trojanized PuTTY distribution
• Malicious npm package exploitation
• Intermediate loader malware (e.g., YouieLoader, SplitLoader) creating malicious services
• Browser information collection via loaders

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Moonstone Sleet’s operations exhibit a rapid, multi‑phase attack cadence: an initial spearphishing or social‑media lure delivers a trojanized download or a game loader; once executed the malware establishes persistence through scheduled tasks and registry entries, then pivots to either deploy Qilin ransomware or exfiltrate data. Victims span high‑value targets—including national governments, defense contractors, financial institutions, and critical infrastructure—often in the United States, Europe, East Asia, and the Middle East. The actor’s pattern of leveraging legitimate software fronts reduces detection chances, while its mix of ransomware and espionage indicates strategic patience to adapt tactics as security controls evolve.

IOC Patterns

• Use of obfuscated or encoded payloads to evade detection
• Creation and use of fake company identities and personas for social engineering
• Distribution of malicious code disguised as a legitimate game
• Domain registrations used for fake companies and personas
• Email addresses harvested from victims
• Insertion of tracking pixels in spearphishing emails
• Registry Run Key entries created by malware
• Scheduled task names used for execution
• Creation of malicious Windows services

Recommended Actions

• Implement detection for obfuscated payloads and encrypted files at the file‑level and network traffic
• Block known Qilin ransomware signatures, hashes, domain indicators, and C2 endpoints in all security devices
• Verify authenticity of third–party software—especially games—before deployment; use vendor signing validation
• Monitor anomalies in financial transaction logs that may indicate ransomware activity or lateral movement
• Subscribe to threat intelligence feeds focused on North Korean actors for up‑to‑date IOCs
• Deploy robust email authentication (SPF, DKIM, DMARC) and monitoring to detect social‑media spearphishing attempts
• Apply application whitelisting or anti‑malware controls to block trojanized applications such as fake PuTTY
• Set alerts for suspicious registry run key modifications and new scheduled tasks on endpoints
• Implement domain reputation filtering to block malicious domains used for C2 or fake personas
• Enforce least privilege and restrict unauthorized Windows service creation

Suggested Tags