A new North Korean hacking group, Moonstone Sleet, has been uncovered engaging in sophisticated cyber-attacks against software and defense companies. Utilizing custom ransomware variants and intricate scams, the group conducts operations seeking both financial gain and intelligence collection. Notably, Moonstone Sleet has shifted tactics from traditional North Korean hacking groups, deploying a ransomware variant called FakePenny and demanding ransoms as high as $6.6 million. This marks a significant escalation in the severity of ransom demands by North Korean threat actors. The group has successfully compromised companies within the defense technology sector, extracting valuable credentials and intellectual property before launching ransomware attacks. Attacks by the hacking group using FakePenny were also observed in incidents involving a drone technology firm and an aircraft parts manufacturer. On top of deploying a new ransomware strain, Moonstone Sleet has employed social engineering through a fabricated tank game, “DeTankWar,” and created multiple fake companies to contact and target individuals and organizations in the IT, education, and software development sectors. These elaborate scams facilitate direct attacks and establish relationships that could provide further access to targets of interest or serve as revenue generation opportunities. The investigation into Moonstone Sleet reveals that the group is well funded, running operations in tangent with other North Korean threat actors like the Lazarus Group and Diamond Sleet. This particular unit has evolved over the years from the shadows of several other North Korean threat actors, still using shared malware and infrastructure from the previous groups it emerged from to deploy its own unique tools, becoming a curated threat actor whose purpose meets specific North Korean cyber objectives. This evolution and the use of ransomware suggest an intent to develop capabilities for disruptive operations in the future. The targeting of software development firms raises concerns about the potential for future supply chain attacks, posing a high risk to a broad range of organizations. These findings highlight the growing sophistication and ambition of North Korean cyber operations, underscoring the need for heightened vigilance and security measures within the global cybersecurity community. CTIX will continue reporting on the latest developments related to emerging threat actors and groups.