Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
Attempted sale of stolen data (NASA, a private U.S. company, UAE government, Spanish healthcare group, Austria-based jet charter) to Stormous ransomware group · 2024
(MSMT/2025/2, report p. 41) “In 2024, DPRK cyber actors attempted to sell stolen information to members of a Russian-speaking ransomware group known as Stormous. The DPRK offered Stormous ransomware actors stolen data from the U.S. National Aeronautics and Science Administration (NASA), a private U.S. company, the UAE government, a Spanish healthcare group, and a private Austria-based jet charter company. One of the DPRK actors used the alias “penygold342@gmail.com,” which private sector researchers and an MSMT Participating State have linked to Moonstone Sleet’s custom ransomware FakePenny.”