Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
Qilin ransomware deployments, including a U.S. healthcare provider · since at least February 2025
(MSMT/2025/2, report p. 39) “Since at least February 2025, DPRK actors associated with Moonstone Sleet leased ransomware capabilities from a non-state, Russia-based cybercrime group named Qilin (also known as Agenda) ... Moonstone Sleet actors deployed Qilin ransomware on multiple victim networks, including a U.S. healthcare provider, using malicious domain, “hiremployee[.]com.””