CVE Intelligence
Home / Threat actors / Moonstone Sleet

Moonstone Sleet G1036

🔔 Create alert

Also known as: Storm-1789

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
33
Techniques
1
Malware and tools

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.

Ransomware operations linked to this group ransomware.live

qilin via Qilin

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance
T1589.002 Email AddressesT1591 Gather Victim Org InformationT1598 Phishing for InformationT1598.003 Spearphishing Link
Resource Development
T1583.001 DomainsT1583.003 Virtual Private ServerT1585.001 Social Media AccountsT1585.002 Email AccountsT1587 Develop CapabilitiesT1587.001 MalwareT1608.001 Upload Malware
Initial Access
T1195.002 Compromise Software Supply ChainT1566.001 Spearphishing AttachmentT1566.003 Spearphishing via Service
Execution
T1053.005 Scheduled TaskT1204.002 Malicious FileT1569.002 Service Execution
Persistence
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder
Stealth
T1027 Obfuscated Files or InformationT1027.009 Embedded PayloadsT1027.013 Encrypted/Encoded FileT1140 Deobfuscate/Decode Files or Information
Credential Access
T1003.001 LSASS Memory
Discovery
T1016 System Network Configuration DiscoveryT1033 System Owner/User DiscoveryT1082 System Information DiscoveryT1217 Browser Information Discovery
Command and Control
T1071.001 Web ProtocolsT1105 Ingress Tool Transfer
Impact
T1486 Data Encrypted for Impact

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.