Moonstone Sleet
IntrusionSet · ATTACK:enterprise:G1036
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1036",
"title": "Moonstone Sleet",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1036",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--e6db1e55-b199-4b6b-8633-989345ee45e0",
"external_id": "G1036",
"domain": "enterprise",
"created": "2024-08-26T17:39:06.020Z",
"modified": "2026-07-31T18:48:24.240Z",
"version": "1.0",
"aliases": [
"Moonstone Sleet",
"Storm-1789"
],
"tactics": [
],
"source_references": [
{
"source_name": "Storm-1789"
},
{
"source_name": "Microsoft Moonstone Sleet 2024",
"url": "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"
}
]
}Explicit source assertions (31)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ae6d331-80eb-4422-bb28-9145e389b377
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b5338ac-c1ca-4296-b06c-44d3730c8557
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10f21b9c-893d-46be-9bf2-50422d380d4f
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--144d9006-95ab-4d14-8243-5c7e035d930c
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:S1242
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c4f833c-496f-4da0-ba46-e1b0ed106284
MIcrosoft Moonstone Sleet Qilin MAR 2025ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d805346-82fa-4912-99e7-a8a5fc112f90
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2310666c-87e1-45ae-bac8-2255215e858a
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1591
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40495023-f12d-4789-8b11-1b14f0a4ea19
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96d8b36d-88b1-4cbc-8cc8-9a22487ab648
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c3459f4-8c8e-4650-bd21-ad506a1a3ee9
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c800f85-0062-40af-9799-fe4a7bcb0526
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4d2042a-c211-4145-a406-e39bc700d652
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6ea2a1c-dfe9-4599-812a-d1f846fb775b
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7a27fb9-551b-4f6c-9d5a-3c230366bd85
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--adeeaadc-9306-4d57-915b-d1e2d07b4387
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b255397e-d2b9-409d-8983-7f5daf4065ce
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5d1e525-1bb7-43a9-8cb6-0a8d9539b465
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb3bc4fe-6695-454e-9215-7b754c5d33f7
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0aedaa7-158f-4f97-a49b-9e6420365f8a
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1598
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5a84306-f745-450a-8c32-8c3d0819fec1
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1195.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb673e8c-4d90-4e12-bfc9-80727e2ded41
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfc5761e-2c94-420a-a985-a4a1d7fe0b7c
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5d39691-0e75-4921-8822-a84566d757a0
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeea996c-6eaf-4244-b5a8-294df9c008c3
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--efd13110-1e89-4e99-b015-4e09046f2b73
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f38fe70e-e940-4884-91e4-d06363f248d3
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1585.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4980470-c6f6-4032-8d99-e707861a4180
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1587
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6072bdd-734e-4fa0-b11a-d02fed4f19ec
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f65ea007-e6e0-4311-a766-4ca60f17a79f
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--faa996f9-3d60-455f-ab31-50687113f24e
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1027.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbf73b94-a193-4b6c-9e04-7f0a279d9ce9
Microsoft Moonstone Sleet 2024