Qilin is a ransomware-as-a-service payload used by both state-sponsored and cybercriminal operators. Since late February 2025, Microsoft observed the North Korean state actor Moonstone Sleet deploying Qilin at a limited number of organizations. The deployment marked the first observed instance of Moonstone Sleet using ransomware developed by a RaaS operator, after previously relying exclusively on its own custom ransomware. The actor combines techniques used by other North Korean groups with distinct methods to pursue financial and cyberespionage objectives. MITRE ATT&CK S1242.