Moonstone Sleet

Moonstone Sleet is a relatively new North Korean threat actor that has rapidly gained notoriety in the cybersecurity landscape. Distinct from other DPRK-linked groups, Moonstone Sleet blends tactics associated with both financially motivated attackers and state-sponsored espionage operations. This dual focus makes them a particularly complex and dangerous adversary. Their operations involve deploying custom ransomware, establishing fake companies and job opportunities, and targeting a wide range of industries globally. Understanding their evolving tactics is crucial for effective defense.

Origins & Evolution

Moonstone Sleet was first identified and tracked by Microsoft in April 2023. While newly named, the group's activities suggest an operational history potentially predating this public identification. Microsoft assesses with high confidence that Moonstone Sleet is a North Korean state-sponsored actor. This assessment is based on observed infrastructure, tools, and techniques that overlap with other known DPRK-linked groups. However, it has clear distinctions as well.

Key aspects of Moonstone Sleet's evolution include:

This continuous evolution and diversification of attack methods demonstrate Moonstone Sleet's adaptability and commitment to expanding its operational capabilities.

Tactics & Techniques

Moonstone Sleet employs a diverse range of tactics, showcasing both sophistication and a willingness to adapt their methods. Their operations can be broadly categorized into several key stages:

* Supply Chain Attacks: They have been observed leveraging compromised legitimate software, creating Trojanized versions of tools like PuTTY and KiTTY.

* Social Engineering: The group creates fake companies and job postings to engage with targets, often through platforms like LinkedIn and Telegram. This elaborate deception is used to deliver malicious payloads or gain access to sensitive information.

* Exploitation of Known Vulnerabilities: Moonstone Sleet targets known vulnerabilities in internet-facing applications and services, such as vulnerable Siscos devices. One should always have a robust strategy for vulnerability assessments to stay ahead of threat actors.

* Custom Malware: They deploy custom malware, including the FakePenny ransomware and other custom backdoors.

* Scheduled Tasks: Malware is often installed and maintained via scheduled tasks.

* Registry Modification: The group modifies registry keys to ensure their malware persists even after reboots. More about Windows registry structure can be found online.

* Credential Theft: They use tools to steal credentials and gain access to other systems.

* Network Scanning: The group scans the network to discover additional targets and resources.

* Remote Desktop Protocol (RDP): RDP is used to move between systems within the network. It is crucial to learn more about Zero Trust Security to prevent such attacks.

* Malware uses hardcoded C2 URLs or retrieves them from websites.

* Use of Telegram bots for C2 communications.

* Deployment of FakePenny custom ransomware.

* In some intrusions, Moonstone Sleet deploys the RUNCALL ransomware, which is publicly available.

* Financial Gain: They deploy ransomware and demand payment for decryption, often engaging in double extortion by threatening to release stolen data.

* If the victim does not pay the ransom, the attackers offer to sell the stolen data.

* Espionage: In some cases, their activities suggest a focus on gathering intelligence and stealing sensitive data, aligning with North Korea's broader strategic objectives.

* The group uses custom loaders to deploy their malware.

* New DLL loaders for delivering additional payloads.

* Development of malicious NPM packages. One must know about the risks of vulnerable components.

Targets or Victimology

Moonstone Sleet's targeting is broad, encompassing various industries and geographic regions. This wide scope reflects their dual motivations of financial gain and espionage:

* Software and technology companies

* Defense industrial base

* Educational institutions

* IT service providers

* Healthcare organizations

* Energy

* United States

* South Korea

* Japan

* Russia

* Europe

* Generating revenue to circumvent international sanctions.

* Gathering intelligence on adversaries and strategic technologies.

* Disrupting critical infrastructure and services in target countries.

* Significant data breaches, exposing sensitive information.

* Operational disruption due to ransomware encryption.

* Financial losses from ransom payments and recovery costs.

* Reputational damage for targeted organizations.

* Theft of source code. More on this topic can be found at Microsoft Security Blog..

Attack Campaigns

Moonstone Sleet has been linked to several notable attack campaigns:

These campaigns highlight Moonstone Sleet's diverse and evolving tactics, showcasing their ability to adapt to different targets and environments.

Defenses

Defending against Moonstone Sleet requires a multi-layered approach that incorporates both proactive and reactive measures:

* Enforce strong, unique passwords and multi-factor authentication (MFA) for all accounts, especially privileged accounts.

* Implement the principle of least privilege, limiting user access to only the resources necessary for their roles.

* Regularly review and update access controls to ensure they remain appropriate.

* Segment the network to limit the lateral movement of attackers in case of a breach.

* Implement strict firewall rules to control traffic between network segments.

* Establish a robust vulnerability management program to identify and remediate known vulnerabilities in software and systems.

* Prioritize patching of internet-facing applications and services.

* Consider decommissioning or isolating end-of-life devices that cannot be patched.

* Conduct regular security awareness training for all employees, focusing on:

* Identifying and reporting phishing emails.

* Recognizing social engineering tactics.

* Safe browsing habits and avoiding suspicious downloads.

* Deploy EDR solutions on all endpoints to detect and respond to malicious activity.

* Configure EDR to monitor for suspicious behaviors, such as unusual process executions, file modifications, and network connections.

* Leverage threat intelligence feeds to stay informed about the latest TTPs used by Moonstone Sleet and other threat actors.

* Use threat intelligence to proactively hunt for indicators of compromise (IOCs) within the network.

* Develop and regularly test an incident response plan to ensure a rapid and effective response to potential breaches.

* The plan should include procedures for containment, eradication, recovery, and post-incident activity. If you don't have one, learn why do you need a cyber incident response plan.

* Carefully vet all third-party software and vendors to ensure they meet security standards.

* Monitor for compromised software updates and apply patches promptly.

* Block network connections to compromised and malicious infrastructure.

* Require MFA for VPN and other remote access solutions.

* Monitor and audit identities and access to critical systems.

* Restrict or block the use of unapproved remote access software. You should use SOAR to make this automation.

Conclusion

Moonstone Sleet represents a significant and evolving threat, combining the characteristics of both financially motivated and state-sponsored actors. Their diverse tactics, broad targeting, and continuous adaptation make them a formidable adversary. Organizations must remain vigilant, proactively implementing robust security measures and staying informed about the latest threat intelligence to effectively defend against this emerging threat. The combination of financial and espionage motivations makes Moonstone Sleet a particularly dangerous actor, requiring a comprehensive and layered defense strategy.

Found this article interesting? Keep visit thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive tips like this. 

You may also like these articles: