APT Explorer

All actors

Moonstone Sleet

Also reported as Storm-1789, Stressed Pungsan and LABYRINTH CHOLLIMA. Linked to North Korea by two sources.

Reports
13
Last reported
Known CVEs
8
Techniques in ATT&CK
30
Origin
North Korea
ID
G1036
Sources
ATT&CKETDAMicrosoft
Merge evidence
2 alias matches

Reports per quarter

Dated reports, 2016 Q3 to 2026 Q3.

Techniques seen in the last two years

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

Show all 29 techniques Show fewer

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Beyond Lazarus: Organization of DPRK cyber capabilities

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. Beyond Lazarus: Organization of DPRK Cyber Capabilities

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. Stressed Pungsan: DPRK-aligned threat actor leverages npm for initial access | Datadog Security Labs

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. MITRE ATT&CK T1082 System Information Discovery

    date ORKL added it ORKL

    Archived copy on ORKL Details

  5. A New North Korean Group Emerges, Disrupting the Open-Source Ecosystem

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. Microsoft: North Korean hackers join Qilin ransomware gang

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 3)

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. Qilin Ransomware-as-a-Service: Threat Analysis and Strategic Outlook

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

Show all 13 reports Show fewer

  1. Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus’s Subgroup - JPCERT/CC Eyes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. Ransomware | Latest Threats | Microsoft Security Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

Newest first. Details opens the report in Explore.