| 01.12.2023 | The North Korean state-aligned hacking group Moonstone Sleet compromised a defence technology company and stole credentials as well as intellectual property in early December 2023 | Not available | Moonstone Sleet / Storm-1789 |
| 2024-05 | FakePenny Ransomware | ZZZ | Moonstone Sleet |
| 01.04.2024 | The North Korean state-aligned hacking group Moonstone Sleet compromised a drone technology company in April 2024 | Not available | Moonstone Sleet / Storm-1789 |
| 28/05/2024 | Multiple organizations | >1 | Moonstone Sleet (previously tracked as Storm-1789) |
| June 13, 2024 | A New North Korean Group Emerges, Disrupting the Open-Source Ecosystem (Moonstone Sleet npm packages) | | Moonstone Sleet; Jade Sleet |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet malicious tank game DeTankWar | | Moonstone Sleet |
| 2024 | Data theft and extortion of a U.S. aerospace company | United States | Moonstone Sleet |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet trojanized PuTTY via LinkedIn, Telegram and freelancing platforms (August 2023) | | Moonstone Sleet (formerly Storm-1789) |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet malicious npm packages / fake skills assessments | | Moonstone Sleet |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet fake companies StarGlow Ventures and C.C. Waterfall email campaigns | | Moonstone Sleet |
| Q2 2024 (from title: APT Quarterly Highlights : Q2 2024) | Moonstone Sleet, Lazarus Kaolin RAT and Kimsuky Gomir/ReconShark activity | South Korea | Kimsuky (Springtail); Moonstone Sleet (Storm-1789); Lazarus Group; Andariel |
| since at least February 2025 | Qilin ransomware deployments, including a U.S. healthcare provider | United States | Moonstone Sleet (affiliate of Qilin) |
| 2026-05-20T13:00:00.000Z | Moonstone Sleet as a Qilin ransomware affiliate (in "Inside the RaaS Ecosystem") | | Moonstone Sleet |
| Not available | The North Korean state-aligned hacking group Moonstone Sleet delivered malicious npm packages to a victim with an associated project and stole its credentials | Not available | Moonstone Sleet / Storm-1789 |