{"actor":{"id":"moonstone-sleet","name":"Moonstone Sleet","aliases":["Storm-1789"],"vendor_names":{"microsoft":"Moonstone Sleet","mandiant":"UNC4899","mitre":"G1036"},"mitre_gid":"G1036","type":"nation-state","type_verbatim":"nation-state APT","secondary_types":[],"origin":"KP","origins":["KP"],"targets":["AR","BE","BR","CA","DE","DK","EE","ES","GB","HU","IL","IN","IT","JP","KR","NL","NZ","PL","RU","SE","SI","TR","UA","VN","ZA"],"target_regions":[],"sectors":["aerospace","agr","consulting-professional-services","consumer-goods-electronics","cryptocurrency","def","edu","energy-utilities","fin","gov","hea","industrials-engineering","manufacturing-man","mar","med","pharmaceutical","tel","transportation"],"threat_types":["fin","ran"],"mitre_techniques":["T1053.005","T1033","T1217","T1003.001","T1589.002","T1591","T1566.001","T1140","T1016","T1547.001","T1486","T1598","T1027","T1071.001","T1195.002","T1583.003","T1105","T1587","T1566.003"],"gir_codes":[],"active_since":2023,"brief":"DPRK cluster engaged in IT-worker fraud and ransomware development.","attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:23.821144+00:00","updated_at":"2026-08-03T17:54:26.174+00:00","url":"https://aptatlas.net/actors/moonstone-sleet"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/moonstone-sleet/stix","navigator":"https://aptatlas.net/api/v1/actors/moonstone-sleet/navigator"}}