Moonstone Sleet Threat Actor Profile Guide: Fake companies, trojanised tools and ransomware explained

Moonstone Sleet is a North Korean actor that builds fake companies, fake games and fake job tests to get developers and defence staff to run its software, then steals credentials and, in some cases, deploys ransomware. Microsoft named the group in May 2024 and describes it as pursuing both espionage and revenue, with targets in software and IT, higher education and the defence industrial base. This profile covers its names and overlap with other North Korean clusters, its targeting, the techniques MITRE ATT&CK records for it, how it abuses developer trust and credentials, the reported campaigns from 2023 to 2025, and the controls that stop it. It is written for security teams in software companies, universities, aerospace and drone suppliers, and for anyone who manages developer workstations or package pipelines. Attribution is as stated by Microsoft and MITRE; the page describes behaviour for defenders only.

Key takeaways

• The lure is a business relationship. Microsoft reports fake firms such as StarGlow Ventures and C.C. Waterfall, LinkedIn and freelancing approaches, and "skills test" projects that hide malicious npm packages.
• Trojanised software does the initial work. A modified PuTTY, a fully playable tank game (DeTankWar and variants) and npm packages all carried loaders that lead to LSASS credential theft.
• Ransomware is part of the playbook. Microsoft saw custom FakePenny ransomware in April 2024 with a 6.6 million US dollar Bitcoin demand, and reported in March 2025 that the group had deployed Qilin ransomware at a limited number of organisations since late February 2025.
• It overlaps with other DPRK clusters. Early activity reused Diamond Sleet malware, and Microsoft lists Moonstone Sleet among clusters pursuing fraudulent IT employment.
• Developer controls are the main defence: isolated environments for take-home tests, package install script controls, software allowlisting, LSASS protection and out-of-band checks on unsolicited "partners".

Who they are (names and aliases)

MITRE ATT&CK (G1036) describes Moonstone Sleet as a North Korean-linked actor carrying out both financially motivated attacks and espionage. It notes the group previously overlapped significantly with Lazarus Group but has differentiated its tradecraft since 2023, and that it is notable for creating fake companies and personas and for malware delivered through a fully functioning game. Microsoft's 28 May 2024 report calls it state-aligned and says its early operations reused Diamond Sleet malware, such as Comebacker, and Diamond Sleet's approach of delivering trojanised software over social media before it moved to its own infrastructure.

Other vendors track overlapping North Korean developer-targeting activity under different names, and their clusters do not map one-to-one to Microsoft's. See the Lazarus Group Threat Actor Profile, the Contagious Interview Threat Actor Profile Guide and the North Korea Cyber Operations Guide for the wider picture.

Targeting and motivation

• Software and IT: companies and individual developers, including job seekers. Microsoft warns that this focus creates supply chain risk, although it had identified no Moonstone Sleet supply chain attack as of May 2024.
• Education: StarGlow Ventures emailed thousands of education and software organisations between January and April 2024; C.C. Waterfall approached higher education about hiring and collaboration.
• Defence industrial base: a defence technology company in December 2023, a drone technology company in April 2024 and an aircraft parts company in May 2024, according to Microsoft's timeline.
• Revenue: ransomware (FakePenny, later Qilin) and attempts to get software development jobs at legitimate companies. Microsoft's June 2025 Jasper Sleet report lists Moonstone Sleet among North Korean clusters pursuing fraudulent employment. See the Insider Threat from Fake IT Workers Guide.

Microsoft assesses the primary goals as espionage and revenue generation. For defenders, both goals start the same way: a person on your staff running something an outsider sent them.

Tactics and techniques (MITRE ATT&CK)

ATT&CK v20 links Moonstone Sleet to 30 techniques and to Qilin ransomware (S1242). All IDs below are listed for G1036 and were checked against ATT&CK v20.

How they abuse identities and credentials

Moonstone Sleet's operations abuse two kinds of identity: the fake identities it builds, and the real credentials its victims hold.

1. Manufacture credible identities: fake companies with websites, staff personas, social media accounts and email domains. StarGlow emails carried no malicious link at all, only a tracking pixel, so mail filters had nothing to block. Verify unsolicited partners through company registries and a call to a number you found yourself.
2. Turn a developer's trust into code execution: the npm "skills test" and the tank game run on the developer's own machine, under their own account, with access to their browser sessions, SSH keys, cloud CLIs and package publishing tokens. See the Malicious Package and Dependency Confusion Guide and the npm Install-Time Security Guide.
3. Use a shared secret as the trigger: the trojanised PuTTY came in a zip with a text file holding an IP address and password. Entering them started the payload, so sandbox analysis without the "credentials" saw nothing.
4. Harvest Windows credentials: Microsoft reports LSASS theft after the npm and game infections, and hands-on-keyboard credential theft on high-value devices.
5. Get hired: pursuing software jobs at real companies would give the group legitimate employee accounts, which no malware detection will flag.

Developer machines hold more non-human credentials than most endpoints: npm and GitHub tokens, cloud access keys and CI secrets. Treat a developer infection as a secrets incident. See the npm Tokens Security Guide and the Developer Workstation and IDE Security Guide.

Notable incidents

For the ransomware side, see the Qilin Threat Actor Profile. The fake-company lure is not unique to this group: the axios npm compromise breach analysis covers a 2026 case that Google Threat Intelligence Group attributed to a different North Korea-nexus cluster, UNC1069, where a fake company and a fake Teams error led a maintainer to install a remote access trojan and lose his npm credentials.

Detection and defence

Controls mapped to behaviours

Phased rollout

1. Week 1: publish a simple rule for engineering and recruiting: code, games or tools from external contacts are never run on a corporate laptop. Provide a disposable cloud VM or sandbox for take-home tests and investor demos.
2. Weeks 2 to 4: set ignore-scripts=true in a managed .npmrc for a pilot group of developers, list the packages that genuinely need install scripts, and allow those explicitly. Roll back per project by overriding the setting if a build breaks.
3. Month 2: enable the Microsoft-recommended ASR rules in audit mode (block executable content from email and webmail, block executables unless they meet prevalence, age or trusted-list criteria, block LSASS credential stealing), review the events, then switch to block.
4. Month 3: move developer secrets out of local files into short-lived credentials (OIDC for CI, SSO-backed CLI sessions) so a stolen laptop yields little.
5. Ongoing: block the domains and IPs Microsoft published, and test backups for restore against a ransomware scenario.

What to monitor

• Developer tools spawning network fetches: node or npm launching curl, rundll32 or PowerShell during install.
• Unsigned or renamed PuTTY binaries and other admin tools not from the software catalogue.
• Access to LSASS from processes started by games or recently downloaded executables.
• New services and scheduled tasks created shortly after a user ran a downloaded file.
• Token use from new locations: npm, GitHub and cloud tokens used from IPs that do not match the developer.

Metrics

• Percentage of developers whose machines enforce install-script controls.
• Percentage of endpoints with the LSASS ASR rule in block mode.
• Number of long-lived developer tokens remaining on endpoints.
• Time from a reported suspicious recruiter or partner contact to blocking its domain.
• Backup restore test success rate for critical systems.

A small software company can cover most of this with a "no external code on work laptops" rule, a throwaway VM service and short-lived tokens. A large defence or technology firm should add hiring identity checks, managed npm and package proxy controls, and threat hunting on developer endpoints.

Common failure patterns

• Running interview code on a work laptop: a skills test that runs npm install executes whatever the package author wrote, with the developer's access.
• Relying on link and attachment scanning: the StarGlow emails had neither; the danger came later in the conversation.
• Trusting a game or tool because it works: DeTankWar was fully playable, and trojanised PuTTY still connected.
• Cleaning malware but not rotating secrets: tokens and keys on an infected developer machine must be treated as stolen.
• Treating ransomware as a separate threat: the same group runs espionage and extortion, so an espionage intrusion can end in encryption.

Practitioner checklist

• Forbid running externally supplied code, tools or games on corporate devices; provide disposable environments instead.
• Enforce npm install-script controls and use an internal package proxy.
• Install admin tools such as PuTTY only from a managed catalogue, and allowlist applications on developer machines.
• Enable LSA protection and the LSASS credential theft ASR rule.
• Replace long-lived developer tokens with short-lived, SSO-backed credentials.
• Verify unsolicited companies, recruiters and investors through independent channels.
• Strengthen hiring identity checks for remote technical roles.
• Keep offline or immutable backups and rehearse ransomware recovery.
• Import Microsoft's published Moonstone Sleet indicators into blocking and hunting tools.

Standards and references

• Microsoft Threat Intelligence: Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks
• MITRE ATT&CK: Moonstone Sleet (G1036)
• Microsoft Threat Intelligence: Jasper Sleet, North Korean remote IT workers' evolving tactics
• MITRE ATT&CK: Qilin (S1242)
• MITRE ATT&CK: Compromise Software Supply Chain (T1195.002)
• BleepingComputer: Microsoft, North Korean hackers now deploying Qilin ransomware
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Malicious Package and Dependency Confusion Guide · Threat Actors Targeting Software Developers Guide · North Korea Cyber Operations Guide · Lazarus Group Threat Actor Profile · Threat Actor Groups Guide