Procedure examples

Moonstone Sleet retrieved credentials from LSASS memory.

Moonstone Sleet has gathered information on victim network configuration.

Moonstone Sleet delivers encrypted payloads in pieces that are then combined together to form a new portable executable (PE) file during installation.

Moonstone Sleet embedded payloads in trojanized software for follow-on execution.

Moonstone Sleet has used encrypted payloads within files for follow-on execution and defense evasion.

Moonstone Sleet deployed various malware such as YouieLoader that can perform system user discovery actions.

Moonstone Sleet used scheduled tasks for program execution during initial access to victim machines.

Moonstone Sleet used curl to connect to adversary-controlled infrastructure and retrieve additional payloads.

Moonstone Sleet has gathered information on victim systems.

Moonstone Sleet retrieved a final stage payload from command and control infrastructure during initial installation on victim systems.

Moonstone Sleet delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.

Moonstone Sleet has distributed a trojanized version of PuTTY software for initial access to victims.

Moonstone Sleet relied on users interacting with malicious files, such as a trojanized PuTTY installer, for initial execution.

Moonstone Sleet deployed malware such as YouieLoader capable of capturing victim system browser information.

Moonstone Sleet has deployed ransomware in victim environments.

Moonstone Sleet used registry run keys for process execution during initial victim infection.

Moonstone Sleet delivered various payloads to victims as spearphishing attachments.

Moonstone Sleet has used social media services to spear phish victims to deliver trojainized software.

Moonstone Sleet used intermediate loader malware such as YouieLoader and SplitLoader that create malicious services.

Moonstone Sleet registered domains to develop effective personas for fake companies used in phishing activity.

Moonstone Sleet registered virtual private servers to host payloads for download.

Moonstone Sleet has created social media accounts to interact with victims.

Moonstone Sleet has created email accounts to interact with victims, including for phishing purposes.

Moonstone Sleet developed malicious npm packages for delivery to or retrieval by victims.

Moonstone Sleet has developed custom malware, including a malware delivery mechanism masquerading as a legitimate game.

Moonstone Sleet gathered victim email address information for follow-on phishing activity.

Moonstone Sleet has gathered information on victim organizations through email and social media interaction.

Moonstone Sleet has interacted with victims to gather information via email.

Moonstone Sleet used spearphishing messages containing items such as tracking pixels to determine if users interacted with malicious messages.

Moonstone Sleet staged malicious capabilities online for follow-on download by victims or malware.