Threat actor

Moonstone Sleet

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 28, 2026 · last 8d ago

Timeline2 articles

North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

Sekoia and Kudelski Security reclassify North Korea's Lazarus umbrella into six clusters spanning espionage, financial theft, and fake IT worker operations.

New research by Sekoia and Kudelski Security, published September 7, divides the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima, mostly under North Korea's military intelligence bureau (GRIB). The former APT38 likely split into CryptoCore and Jade Sleet, focused on cryptocurrency, Web3, and blockchain targets. Moonstone Sleet combines espionage with financially motivated operations, using custom malware alongside Qilin ransomware-as-a-service. Thousands of fake IT workers generate regime revenue and provide access, linked to incidents like the $62.5M Munchables protocol theft.

Infosecurity MagazineSep 7, 11:00 UTC · 8d agoThreat actor

ATF confirms cyberattack hit system containing info on its investigation targets

Qilin ransomware group claimed breaching the ATF, exposing data on investigation targets; the agency says a standalone system was hit with no mission impact.

The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed a cyberattack on a standalone system holding information about targets of ATF investigations, designated a major incident, with no impact on case management, lab, or eForms systems. Qilin, a Russian-speaking affiliate-based ransomware group, claimed responsibility, though ATF declined to confirm involvement or the root cause. Qilin has claimed hundreds of victims across 60+ countries since 2022 and partners with Scattered Spider and Moonstone Sleet.

CyberScoopAug 28, 20:29 UTC · 18d agoRansomware in the wild

Appears with

threat actor Qilin 2 threat actor BianLian 1 threat actor Citrine Sleet 1 threat actor CryptoCore 1 threat actor Famous Chollima 1 threat actor Jade Sleet 1 threat actor Lazarus Group 1 threat actor Scattered Spider 1 threat actor TEMP.Hermit 1 organization Department of Justice 1 organization FBI 1 organization Google 1 organization GRIB 1 organization Halcyon 1 vendor Kudelski Security 1 vendor Sekoia 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.