{"actor":{"id":"moonstone-sleet","name":"Moonstone Sleet","aliases":["Storm-1789"],"vendor_names":{"microsoft":"Moonstone Sleet","mandiant":"UNC4899"},"mitre_gid":null,"type":"nation-state","type_verbatim":"nation-state APT","secondary_types":[],"origin":"KP","origins":["KP"],"targets":["AR","BE","BR","CA","DE","DK","EE","ES","GB","HU","IL","IN","IT","JP","KR","NL","NZ","PL","RU","SE","SI","TR","UA","VN","ZA"],"target_regions":[],"sectors":["fin","tel","def","energy-utilities","edu","mar","agr","gov","consumer-goods-electronics","manufacturing-man","pharmaceutical","transportation","consulting-professional-services","cryptocurrency","industrials-engineering","aerospace","med","hea"],"threat_types":["fin","ran"],"mitre_techniques":["T1053.005","T1033","T1217","T1003.001","T1589.002","T1591","T1566.001","T1140","T1016","T1547.001","T1486","T1598","T1027","T1071.001","T1195.002","T1583.003","T1105","T1587","T1566.003"],"gir_codes":[],"active_since":2023,"brief":"DPRK cluster engaged in IT-worker fraud and ransomware development.","attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:23.821144+00:00","updated_at":"2026-07-29T07:58:32.853+00:00","url":"https://aptatlas.net/actors/moonstone-sleet"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/moonstone-sleet/stix","navigator":"https://aptatlas.net/api/v1/actors/moonstone-sleet/navigator"}}