Actors/Nation-state / APT/Asia

Moonstone Sleet

G1036APTKP · North Korea

AKA Storm-1789

Mandiant: UNC4899MITRE: G1036

DPRK cluster engaged in IT-worker fraud and ransomware development.

Targets25

Sectors18

Threat types2

GIRs mapped0/480

Active since2023

Explore in atlas

Also tracked as

3 vendor names · 1 other aliases

Open Rosetta Stone

Mandiant

UNC4899

Microsoft

Moonstone Sleet

MITRE

G1036

UNATTRIBUTED ALIASESStorm-1789

Victimology

Geographic footprint · 25 countries

Export STIX

origin · North Koreatargeted countries · 25

AMERICAS · 3

Argentina · Brazil · Canada

EUROPE · 14

Belgium · Germany · Denmark · Estonia · Spain · United Kingdom · Hungary · Italy · Netherlands · Poland · Russia · Sweden · Slovenia · Ukraine

ASIA · 6

Israel · India · Japan · South Korea · Türkiye · Vietnam

OCEANIA · 1

New Zealand

AFRICA · 1

South Africa

Sectors targeted

18 of 40

Government100 actors Defense72 actors Aerospace58 actors Financial Services73 actors Cryptocurrency20 actors Healthcare46 actors Pharmaceutical26 actors Telecom71 actors Energy / Utilities58 actors Education & Research62 actors Manufacturing (man)49 actors Media & Journalism48 actors Transportation31 actors Consulting / Professional Services34 actors Industrials / Engineering28 actors Consumer Goods / Electronics19 actors Agriculture & Food18 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

FIN · Financial FraudRAN · Ransomware

MITRE ATT&CK · 19 techniques

Reconnaissance · 3

T1589.002Email Addresses T1591Gather Victim Org Information T1598Phishing for Information

Resource Development · 2

T1583.003Virtual Private Server T1587Develop Capabilities

Initial Access · 3

T1195.002Compromise Software Supply Chain T1566.001Spearphishing Attachment

Execution · 1

T1053.005Scheduled Task

Persistence · 1

Credential Access · 1

T1003.001LSASS Memory

Discovery · 3

T1016System Network Configuration Discovery

Impact · 1

T1486Data Encrypted for Impact

Command And Control · 2

T1071.001Web Protocols

Stealth · 2

T1027Obfuscated Files or Information

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer19 techniques · layer format 4.5

Related actors

By origin and actor type

T1566.003

Spearphishing via Service

T1547.001

Registry Run Keys / Startup Folder

T1033

System Owner/User Discovery

T1217Browser Information Discovery

T1105

Ingress Tool Transfer

T1140

Deobfuscate/Decode Files or Information