The group has deployed an advanced custom ransomware strain targeting financial institutions and cryptocurrency exchanges across Southeast Asia and Europe, demonstrating evolving technical capabilities and evasion techniques not previously observed in North Korean cyber operations. Unlike previous North Korean ransomware operations, Moonstone Sleet demonstrates a sophisticated understanding of enterprise security architectures and implements countermeasures specifically designed to bypass modern endpoint protection platforms. Attribution to North Korea stems from code similarities with previously documented DPRK operations, shared command infrastructure with known North Korean campaigns, and targeting patterns consistent with Pyongyang’s financial motivations. Network defenders have identified several command and control servers hosted on compromised infrastructure across Eastern Europe and Southeast Asia, with traffic routed through multiple proxies to obscure the attackers’ true location. Organizations are advised to implement robust email filtering, maintain regular offline backups, deploy application control solutions, and monitor for indicators of compromise which security vendors have begun distributing through standard threat intelligence channels. Additionally, the ransomware contains timing checks that prevent execution during working hours in the UTC+9 time zone, a common trait in North Korean malware. Moonstone Sleet, believed to operate under the umbrella of North Korea’s Reconnaissance General Bureau, has developed a multi-stage infection chain that begins with targeted spear-phishing emails containing seemingly benign PDF attachments. The ransomware communicates with command and control servers through a custom protocol that mimics legitimate HTTPS traffic, but embeds commands within seemingly normal web requests. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The infrastructure demonstrates sophisticated operational security measures including rapid server rotation and geofenced access controls that trigger self-destruction if accessed from unauthorized IP ranges.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 10 Mar 2025 08:00:08 +0000