FakePenny Ransomware · 2024-05
In April 2024, Microsoft observed Moonstone Sleet deploying FakePenny, a custom ransomware loader and encryptor, against a company the actor had previously compromised in February. Microsoft assessed the deployment as financially motivated and significant because it was the first observed ransomware use by Moonstone Sleet, a distinct North Korean state-aligned actor that also uses fake companies, job or developer outreach, trojanized PuTTY and npm projects, IT-worker activity, and malicious game-themed lures.
The North Korean state-aligned hacking group Moonstone Sleet compromised an unspecified company in April 2024 with the FakePenny ransomware · 01.04.2024
The North Korean state-aligned hacking group Moonstone Sleet (previously tracked as Storm-1789) compromised an unspecified company in April 2024 with the FakePenny ransomware, Microsoft reported in a technical report on 28 May 2024.
According to the report, the hacker group is said to have been financially motivated and demanded $6.6 million in bitcoins from the company that they had previously compromised in February.
Targeting of aerospace and defense organizations worldwide · May 2024
Moonstone Sleet, a North Korean actor identified in May 2024, developed a custom ransomware variant called FakePenny, which it deployed at organizations in aerospace and defense after exfiltrating data from the compromised networks.
FakePenny Ransomware · 2024-05
Reported: 2024-05; Victims: FakePenny Ransomware; Motivations: FinancialGain; Sectors: Defense; Countries: Worldwide
FakePenny ransomware at a U.S. defense contractor · 2024
(MSMT/2025/2, report p. 39) “In 2024, Moonstone Sleet actors deployed multiple ransomware loaders and implants, such as a set of tools referred to as FakePenny, to encrypt files at a U.S. defense contractor and demanded that BTC payments be sent to DPRK-controlled cryptocurrency addresses (bc1q64jk7kra50eezk0hk6nxfqe42yrq23cwcemdg6 and bc1qaejck84j2w7xl24m9y35p5rhqv0sy8fwq00g0j).”
Moonstone Sleet FakePenny ransomware against a previously compromised defense technology company · 2024-05-28T16:00:00+00:00 (published_time)
In April 2024, Microsoft observed Moonstone Sleet delivering a new custom ransomware variant we have named FakePenny against a company it previously compromised in February. ... The ransom demand was $6.6M USD in BTC. ... In early December 2023, we observed Moonstone Sleet compromising a defense technology company to steal credentials and intellectual property. In April 2024, the actor ransomed the organization using FakePenny.
Moonstone Sleet FakePenny ransomware at aerospace and defense organizations · Microsoft Digital Defense Report 2024
Moonstone Sleet, a new North Korean actor identified in May 2024, developed a custom ransomware variant called FakePenny which it deployed at organizations in aerospace and defense after exfiltrating data from the impacted networks.
North Korean threat actor behind new ransomware (Moonstone Sleet, FakePenny) · 2024-05-29T16:29:58+00:00
A relatively new group of North Korean cybercriminals has been found deploying FakePenny ransomware. ... In a security blog , Microsoft has revealed some of the tactics being used by a relatively new group of cybercriminals operating out of North Korean, that it calls Moonstone Sleet (formerly Storm-1789).