MITRE identifies Moonstone Sleet as a North Korean-linked threat actor conducting both financially motivated operations and espionage, with earlier overlap with Lazarus Group before its tradecraft diverged in 2023. The group uses fake companies, personas, email accounts, and social media accounts to interact with victims, gather organizational and email information, and support phishing activity. Its delivery methods include spearphishing attachments, spearphishing via services, tracking links, malicious npm packages, trojanized software such as PuTTY, and a malware delivery mechanism masquerading as a functioning game. Documented tooling and behaviors include YouieLoader and SplitLoader service creation, browser and system discovery, encrypted or embedded payload staging, credential retrieval from LSASS, registry run keys, scheduled tasks, and final payload downloads from adversary-controlled infrastructure. The ATT&CK mapping matters because it distinguishes Moonstone Sleet’s post-2023 techniques from broader Lazarus-linked activity while preserving the DPRK attribution context.