← Back to Actors
Moonstone Sleet
Moonstone SleetStorm-1789
[Moonstone Sleet](https://attack.mitre.org/groups/G1036) is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, [Lazarus Group](https://attack.mitre.org/groups/G0032), but has differentiated its tradecraft since 2023. [Moonstone Sleet](https://attack.mitre.org/groups/G1036) is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.(Cit...
30
Techniques
26
Covered
4
Gaps
87%
Coverage
Coverage26/30
GAPS (4)
COVERED (26)
T1003.001LSASS Memory111 det.T1016System Network Configuration Discovery41 det.T1027Obfuscated Files or Information707 det.T1027.009Embedded Payloads2 det.T1027.013Encrypted/Encoded File8 det.T1033System Owner/User Discovery62 det.T1053.005Scheduled Task100 det.T1071.001Web Protocols83 det.T1082System Information Discovery91 det.T1105Ingress Tool Transfer199 det.T1140Deobfuscate/Decode Files or Information59 det.T1195.002Compromise Software Supply Chain24 det.T1204.002Malicious File468 det.T1217Browser Information Discovery4 det.T1486Data Encrypted for Impact400 det.T1547.001Registry Run Keys / Startup Folder53 det.T1566.001Spearphishing Attachment1144 det.T1566.003Spearphishing via Service107 det.T1569.002Service Execution65 det.T1583.001Domains69 det.T1587Develop Capabilities4 det.T1587.001Malware10 det.T1589.002Email Addresses2 det.T1598Phishing for Information1205 det.T1598.003Spearphishing Link353 det.T1608.001Upload Malware3 det.