Atlas Actors Sectors Requirements

⌘K

Atlas Actors Sectors Requirements

LOADING

Moonstone Sleet (aka Storm-1789) · APT Atlas

Actors/Nation-state / APT/Asia

Moonstone Sleet

APTKP · North Korea

AKA Storm-1789

DPRK cluster engaged in IT-worker fraud and ransomware development.

Targets25

Sectors18

Threat types2

GIRs covered0/480

Active since2023

QUICK FACTS

TypeNation-state / APT

OriginNorth Korea

First seen2023

Type (verbatim)nation-state APT

GIR coverage0/480

TTPs19

Targets25

Sectors18

Victimology

Geographic footprint · 25 countries

origin · North Koreatargeted countries · 25

AMERICAS · 3

Argentina · Brazil · Canada

EUROPE · 14

Belgium · Germany · Denmark · Estonia · Spain · United Kingdom · Hungary · Italy · Netherlands · Poland · Russia · Sweden · Slovenia · Ukraine

ASIA · 6

Israel · India · Japan · South Korea · Türkiye · Vietnam

OCEANIA · 1

AFRICA · 1

Sectors targeted

18 of 40

Government83 actors Defense60 actors Aerospace49 actors Financial Services61 actors Cryptocurrency17 actors Healthcare38 actors Pharmaceutical24 actors Telecom57 actors Energy / Utilities49 actors Education & Research50 actors Manufacturing (man)40 actors Media & Journalism41 actors Transportation25 actors Consulting / Professional Services26 actors Industrials / Engineering23 actors Consumer Goods / Electronics16 actors Agriculture & Food15 actors Maritime21 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

FIN · Financial FraudRAN · Ransomware

MITRE ATT&CK · 19 techniques

Reconnaissance · 3

T1589.002Email Addresses T1591Gather Victim Org Information T1598Phishing for Information

Resource Development · 2

T1583.003Virtual Private Server T1587Develop Capabilities

Initial Access · 3

T1195.002Compromise Software Supply Chain T1566.001Spearphishing Attachment

Execution · 1

T1053.005Scheduled Task

Persistence · 1

Credential Access · 1

T1003.001LSASS Memory

Discovery · 3

T1016System Network Configuration Discovery

Impact · 1

T1486Data Encrypted for Impact

Command And Control · 2

T1071.001Web Protocols

Stealth · 2

T1027Obfuscated Files or Information

GIR coverage

0 / 480 requirements satisfied

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

APT2nation-state

China · 6 targets · since 2010

APT5nation-state

China · 15 targets · since 2007

APT8nation-state

China · 5 targets · since —

APT14nation-state

China · 15 targets · since —

APT17nation-state

China · 10 targets · since 2009

APT20nation-state

China · 14 targets · since 2011

T1566.003

Spearphishing via Service

T1547.001

Registry Run Keys / Startup Folder

T1033

System Owner/User Discovery

T1217Browser Information Discovery

T1105

Ingress Tool Transfer

T1140

Deobfuscate/Decode Files or Information