Storm-1789
2024-05-28 • Microsoft • Moonstone Sleet emerges as new North Korean threa…
Storm-1789 was Microsoft’s temporary designation for the North Korean activity cluster that the company renamed Moonstone Sleet in May 2024. Microsoft initially observed the cluster overlapping with Diamond Sleet through reused Comebacker code and delivery of trojanized software over social media, but later separated it after the actor adopted bespoke infrastructure and conducted concurrent operations. Under its mature identity, the group pursued both espionage and revenue generation by creating fake software and blockchain companies, impersonating recruiters and developers, distributing malicious npm packages and trojanized applications, operating a weaponized tank game, seeking legitimate IT employment, and deploying FakePenny ransomware. It targeted software developers, education organizations, defense technology companies, drone manufacturers, and aircraft-parts companies. The transition from Storm-1789 to Moonstone Sleet therefore reflects Microsoft’s evolution from provisional activity tracking to recognition of a distinct and well-resourced actor.
-
60
Related Actors
-
1
Related Reports
Related Actors
Related Reports
Top Authors
View all reports in this cluster