Moonstone Sleet: New North Korean APT Infrastructure Targeting Global Defense Sector

Executive Summary\n\nMicrosoft Threat Intelligence (MSTIC) has uncovered a new North Korean threat actor, designated Moonstone Sleet (formerly tracked as Storm-1789). This group exhibits a unique blend of espionage and financially motivated tactics, specifically targeting the defense, aerospace, and software development sectors. Their operations represent a significant shift in North Korean cyber strategy, focusing on high-effort social engineering and custom-built malicious infrastructure.\n\n## Threat Analysis\n\nMoonstone Sleet employs highly sophisticated social engineering to gain initial access. They have been observed creating entirely fictitious companies, such as "Starry Sky Software," to engage potential victims on platforms like LinkedIn and X (formerly Twitter). Their campaigns often involve the distribution of a malicious tank-themed game called "DeTank," which contains hidden backdoors designed to compromise the host system. This approach deviates from standard phishing by building long-term rapport with targets before delivering a payload.\n\n## Technical Details\n\nThe group utilizes a custom loader known as "LandUpdate." This loader is responsible for establishing persistence, conducting environment reconnaissance, and downloading secondary payloads. The "DeTank" game uses a DLL side-loading technique to execute malicious code within a legitimate process memory space, evading traditional signature-based detection. Once established, the actor deploys a customized version of the "Youie" information stealer to harvest credentials, browser history, and system metadata, which is then exfiltrated to a rotating set of command-and-control (C2) servers hosted on VPS providers.\n\n## Attribution Assessment\n\nMSTIC identifies Moonstone Sleet as a distinct North Korean state-sponsored unit with high confidence. While they share some infrastructure and overlapping techniques with the Lazarus Group (specifically Diamond Sleet), their specific focus on creating fake corporate entities and unique malware sets them apart as a specialized operational cell under the Reconnaissance General Bureau (RGB). The infrastructure overlaps suggest shared resources but independent mission planning.\n\n## Implications\n\nThe emergence of Moonstone Sleet indicates an evolution in DPRK cyber tactics, moving away from simple bulk phishing toward complex, long-term persona building. The inclusion of both intellectual property theft and potential financial theft capabilities suggests a dual mandate to support both military modernization and the North Korean regime's revenue generation. This makes them a high-priority threat for defense contractors and technical firms worldwide.\n\n## Recommendations\n\nOrganizations should implement strict application control policies to prevent the execution of unsigned or unknown software, particularly games or 'free' utility tools. Security teams are advised to monitor for network connections to known Moonstone Sleet command-and-control IP ranges and to educate employees on the risks of sophisticated social engineering on professional networking sites. Multi-factor authentication (MFA) and EDR solutions should be tuned to detect unusual DLL loading behavior from non-standard applications.