Moonstone Sleet

Moonstone Sleet is the IT-worker and Contagious Interview playbook scaled up: instead of a fabricated engineer, the cluster registers a company with a website, staff profiles and a product, which approaches targets as a vendor or partner. Reporting describes trojanised games, npm packages and a bespoke tank-battle game lure.

It is also where revenue lines otherwise kept apart run together: it has been reported taking a salary as a contractor, selling software and deploying ransomware against an organisation it already worked inside. That mixture is why it is a separate cluster rather than under Lazarus Group.

Named individuals

None profiled on this site yet

Fabricated personas

2 reconstructed from reported accounts

Indicators

115 in the searchable index

Hunts

None in the hunt library

How it differs from the other clusters here

The fabricated company is the tradecraft: a target that would refuse a stranger's archive accepts a build from a vendor it believes it contracted.

The indicators that follow are ordinary (package names, hashes, infrastructure); the thing to recognise is the shell in front of them.

The cluster is also placed on the fraudulent-employment side, so an organisation can meet it twice, as applicant and as supplier.

Compare Lazarus GroupAPT38KimsukyRGB (Reconnaissance General Bureau)Remote Worker Fraud / Contagious InterviewAndarielAPT37KonniPolinRider

What a defender would see

Diligence on a small software vendor is the control, and a procurement question before a security one.

Ask how old the company is, who its named staff are elsewhere on the web, and whether anything existed before first contact.

After first contact, observables are those described elsewhere on this site: a package pulled from a registry, an unexpected build, an unusual outbound connection.

Identities assembled from the accounts, addresses and portfolio sites reported under one name. A persona is a reporting artefact rather than a person: several may be run by one operator, and one may be run by several.

• Marcin Iwanski LIVE
• No photographnewstable

Indicators

The 115 indicators the index holds under this cluster. The complete index is on Remote Workers.

Show more results

Where the evidence comes from

Show 50 more

Further reading

Published research on this cluster. None of it is this site’s work.

• Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks Microsoft · 2024-05-28

• Moonstone Sleet: MITRE ATT&CK group entry MITRE · 2026-07-31

  Dated to the entry's last modification on ATT&CK.