Moonstone Sleet malicious tank game DeTankWar

Date (as written): 2024-05-28T16:00:00+00:00 (published_time)
Year: 2024
Actors (as written): Moonstone Sleet
Actor pages: Moonstone Sleet
Tags (as written): blockchain lure

Source entries (2)

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

DeTankWar malicious DeFi game (fake company C.C. Waterfall) · early 2024

(MSMT/2025/2, report p. 23) “In early 2024, a DPRK IT worker manager based in North Korea, Sin Chong Min, was responsible for developing a decentralized finance (DeFi) cryptocurrency-based game and associated site, detankwar[.]com, with the aim to obtain device and account credentials from victims and steal cryptocurrency according to an MSMT Participating State. During the same period, according to Microsoft, Moonstone Sleet actors established a fake company called C.C. Waterfall to promote a fully functional but malicious online game that the actors developed called, “DeTankWar,” which was a fraudulent copy of a real game, ”DeFi Tank Land.””

https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/pdfs/2025-10-22_MSMT-Report.pdf

Microsoft Threat Intelligence (Microsoft Security Blog)

Moonstone Sleet malicious tank game DeTankWar · 2024-05-28T16:00:00+00:00 (published_time)

Since February 2024, Microsoft has observed Moonstone Sleet infecting devices using a malicious tank game it developed called DeTankWar (also called DeFiTankWar, DeTankZone, or TankWarsZone).

https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/

Suggest a correction on GitHub