Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Moonstone Sleet

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.(Citation: Microsoft Moonstone Sleet 2024)

ID: G1036

Associated Groups: Storm-1789

Created: 26 Aug 2024

Last Modified: 01 Oct 2024

Name	Description
Associated Group Descriptions
Storm-1789	(Citation: Microsoft Moonstone Sleet 2024)

Domain	ID		Name	Use
Techniques Used
Enterprise	T1583	.001	Acquire Infrastructure: Domains	Moonstone Sleet registered domains to develop effective personas for fake companies used in phishing activity.(Citation: Microsoft Moonstone Sleet 2024)
		.003	Acquire Infrastructure: Virtual Private Server	Moonstone Sleet registered virtual private servers to host payloads for download.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1071	.001	Application Layer Protocol: Web Protocols	Moonstone Sleet used curl to connect to adversary-controlled infrastructure and retrieve additional payloads.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1547	.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Moonstone Sleet used registry run keys for process execution during initial victim infection.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1587	.001	Develop Capabilities: Malware	Moonstone Sleet has developed custom malware, including a malware delivery mechanism masquerading as a legitimate game.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1585	.001	Establish Accounts: Social Media Accounts	Moonstone Sleet has created social media accounts to interact with victims.(Citation: Microsoft Moonstone Sleet 2024)
		.002	Establish Accounts: Email Accounts	Moonstone Sleet has created email accounts to interact with victims, including for phishing purposes.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1589	.002	Gather Victim Identity Information: Email Addresses	Moonstone Sleet gathered victim email address information for follow-on phishing activity.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1003	.001	OS Credential Dumping: LSASS Memory	Moonstone Sleet retrieved credentials from LSASS memory.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1027	.009	Obfuscated Files or Information: Embedded Payloads	Moonstone Sleet embedded payloads in trojanized software for follow-on execution.(Citation: Microsoft Moonstone Sleet 2024)
		.013	Obfuscated Files or Information: Encrypted/Encoded File	Moonstone Sleet has used encrypted payloads within files for follow-on execution and defense evasion.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1566	.001	Phishing: Spearphishing Attachment	Moonstone Sleet delivered various payloads to victims as spearphishing attachments.(Citation: Microsoft Moonstone Sleet 2024)
		.003	Phishing: Spearphishing via Service	Moonstone Sleet has used social media services to spear phish victims to deliver trojainized software.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1598	.003	Phishing for Information: Spearphishing Link	Moonstone Sleet used spearphishing messages containing items such as tracking pixels to determine if users interacted with malicious messages.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1053	.005	Scheduled Task/Job: Scheduled Task	Moonstone Sleet used scheduled tasks for program execution during initial access to victim machines.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1608	.001	Stage Capabilities: Upload Malware	Moonstone Sleet staged malicious capabilities online for follow-on download by victims or malware.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1195	.002	Supply Chain Compromise: Compromise Software Supply Chain	Moonstone Sleet has distributed a trojanized version of PuTTY software for initial access to victims.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1569	.002	System Services: Service Execution	Moonstone Sleet used intermediate loader malware such as YouieLoader and SplitLoader that create malicious services.(Citation: Microsoft Moonstone Sleet 2024)
Enterprise	T1204	.002	User Execution: Malicious File	Moonstone Sleet relied on users interacting with malicious files, such as a trojanized PuTTY installer, for initial execution.(Citation: Microsoft Moonstone Sleet 2024)

ID	Name	References	Techniques
Software

References

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Moonstone Sleet

Associated Group Descriptions

Techniques Used

Software

References