Microsoft has named yet another state-aligned threat actor: Moonstone Sleet, which engages in cyberespionage and ransomware attacks to further goals of the North Korean regime.
Delivered a trojanized version of PuTTY via LinkedIn, Telegram, and developer freelancing platforms to saddle victims with custom malware loaders.
Used malicious npm packages to deliver malicious payloads Delivered a custom ransomware variant to a company it previously compromised, and asked for $6.6M in BTC to decrypt files.
They used tracking pixels and a dummy unsubscribe page to confirm which targets engaged with the emails.
Moonstone Sleet emails a link to the DeTankWar game.
The linked executable included malicious DLLs that deliver a custom malware loader, which loads malicious payloads in memory and creates malicious services for network and user discovery and browser data collection.
Finally, the group also tried to get employed as software developers at multiple legitimate companies.
This type of access could be used to mount software supply chain attacks.
The group has been spotted targeting a company that makes drone technology and another one that makes aircraft parts, a defense technology company, and organizations in the software/IT and education sectors.
Microsoft has shared recommendations, indicators of compromise and hunting queries organizations can use to mitigate the threat of a Moonstone Sleet attack or to spot evidence of a successful one.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Wed, 29 May 2024 13:13:06 +0000