By 
Microsoft has linked a North Korean hacking group named Moonstone Sleet to FakePenny ransomware attacks, which have led to millions of dollars in ransom demands.
Previously tracked as Storm-1789, Moonstone Sleet was found attacking both financial and cyberespionage targets using trojanized software (e.g., PuTTY), malicious games and npm packages, custom malware loaders, and fake software development companies (e.g., StarGlow Ventures, C.C. Waterfall) set up to interact with potential victims on LinkedIn, Telegram, freelancing networks, or via email.
When Microsoft first detected Moonstone Sleet activity, the actor demonstrated strong overlaps with Diamond Sleet, reusing code from known Diamond Sleet malware like Comebacker and using well-established Diamond Sleet techniques to gain access to organizations, such as using social media to deliver trojanized software.
The threat actors were first seen deploying a new custom FakePenny ransomware variant in April, two months after breaching the victim's network. The ransom demanded by the Moonstone Sleet attackers was $6.6 million in BTC.
Microsoft's assessment of this attack concluded that Moonstone Sleet's primary motivation for deploying the ransomware was financial gain.
Since it was first observed, the group has targeted multiple industry verticals, including individuals and organizations in the software and information technology, education, and defense industrial base sectors.
Moonstone Sleet's diverse set of tactics is notable not only because of their effectiveness, but because of how they have evolved from those of several other North Korean threat actors over many years of activity to meet North Korean cyber objectives002E
