Microsoft: Moonstone Sleet APT Melds Espionage, Financial Goals

North Koreas newest threat actor uses every trick in the nation-state APT playbook, and most of cybercrimes tricks, too. It also developed a whole video game company to hide malware.

Researchers at Microsoft have identified a North Korean threat group carrying out espionage and financial cyberattacks concurrently, using a grab bag of different attack techniques against aerospace, education, and software organizations and developers.
In the beginning,
Microsoft explained in a blog post
, Moonstone Sleet heavily overlapped with the known DPRK advanced persistent threat (APT)
Diamond Sleet
. The former copped from the latters malware — like
the Comebacker Trojan
— as well as its infrastructure and preferred techniques — such as delivering Trojanized software via social media. Moonstone Sleet has since differentiated itself, though, moving to its own infrastructure and establishing for itself a unique, if rather erratic identity.
For one thing, where some of Kim Jong-Uns threat groups
focus on espionage
and others
focus on stealing money
, Moonstone Sleet does both. Having its hands in every pie is reflected in its tactics, techniques, and procedures (TTPs), too, which in various cases have involved fake job offers, custom ransomware, and even a fully functional fake video game.
Moonstone Sleets ability to blend traditional cybercriminal methodologies with those of nation-state actors is particularly alarming, says Adam Gavish, co-founder and CEO at DoControl. Their multifaceted strategies — ranging from setting up fake companies to deliver custom ransomware to using compromised tools for direct infiltration — showcase a versatility that complicates defensive measures.
To Gavish, One tactic that stands out is their utilization of trusted platforms, like LinkedIn and Telegram, and developer freelancing websites to target victims. This exploits the inherent trust associated with these platforms, making it easier for them to trick victims into interacting with malicious content.
To add to the realism, Moonstone Sleet uses the
common North Korean strategy
of engaging with victims from the perspective of a seemingly legitimate company.
From January to April of this year, for example, the group masqueraded as a software development company called StarGlow Ventures. With a sleek custom domain, made-up employees, and social media accounts to go along with it all, StarGlow Ventures targeted thousands of organizations in the software and education sectors. In phishing emails, the faux company complemented its victims and offered to collaborate on upcoming projects.
In other cases, the group used another fake company — C.C. Waterfall — to spread an especially creative ruse.
In emails from C.C. Waterfall since February, Moonstone Sleet has been reaching out to victims with a link to download a video game. DeTankWar — also called DeFiTankWar, DeTankZone, or TankWarsZone — is marketed as a community-driven,
play-to-earn
tank combat game. It has its own websites, and X accounts for fake personas used to promote it.
Remarkably, DeTankWar is a fully functional (if atavistic) video game. When users launch it, though, they also download malicious DLLs with a custom loader called YouieLoad. YouieLoad loads malicious payloads to memory, and creates services that probe victim machines and collect data, and allow its owners to perform extra hands-on command execution.
Fake companies and fake video games are just some of Moonstone Sleets tricks. Its members also
try to get hired for remote tech jobs
with real companies. It spreads malicious npm packages on LinkedIn and freelancer websites. It has its own ransomware, FakePenny, which it uses in conjunction with a ransom note ripped from NotPetya to solicit millions of dollars worth of Bitcoin.
In the face of such varied TTPs and malicious tools, Gavish says, The answer is fundamentally the same as for any other threat: Defenders must adopt a multi-layered security posture. This involves a combination of endpoint protection, network monitoring, and threat hunting to detect and respond to anomalous activities early. Microsoft took a similarly broad stance in its blog, highlighting network and tamper protections, endpoint detection and response (EDR), and more steps organizations can take to layer their cyber defenses.
Ultimately, says Gavish, the dynamic nature of threats like Moonstone Sleet requires a holistic and adaptive approach to cybersecurity — one that balances technical defenses with strategic intelligence and continuous vigilance.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft: Moonstone Sleet APT Melds Espionage, Financial Goals