Loading threat actor…
Moonstone Sleet, also tracked as Storm-1789, is a North Korean state-sponsored threat actor conducting both cyberespionage and financially motivated operations. Its activities combine intelligence collection with ransomware deployment and extortion for revenue generation. The group uses custom malware as well as established ransomware-as-a-service offerings. It deployed its custom FakePenny ransomware in 2024 and was identified deploying Qilin ransomware in March 2025, operating as a Qilin affiliate rather than the platform’s core operator. Moonstone Sleet belongs to the broader North Korean cyber ecosystem historically associated with the Lazarus umbrella, while being tracked as a distinct operational cluster.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
66 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
13 malware families Mallory has associated with this actor across public reporting.
8 additional families tracked in Mallory.
4 CVEs Mallory has associated with this actor across public reporting. 4 of them are exploited in the wild (not necessarily by this actor).
52 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.