Moonstone Sleet
- ID
- G1036
- Associated names
- Storm-1789
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.[1]
Techniques used (30)
- T1003.001 LSASS Memory
- T1016 System Network Configuration Discovery
- T1027 Obfuscated Files or Information
- T1027.009 Embedded Payloads
- T1027.013 Encrypted/Encoded File
- T1033 System Owner/User Discovery
- T1053.005 Scheduled Task
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1140 Deobfuscate/Decode Files or Information
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1217 Browser Information Discovery
- T1486 Data Encrypted for Impact
- T1547.001 Registry Run Keys / Startup Folder
- T1566.001 Spearphishing Attachment
- T1566.003 Spearphishing via Service
- T1569.002 Service Execution
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1587 Develop Capabilities
- T1587.001 Malware
- T1589.002 Email Addresses
- T1591 Gather Victim Org Information
- T1598 Phishing for Information
- T1598.003 Spearphishing Link
- T1608.001 Upload Malware