North Korea-Linked APT Group Moonstone Sleet Uses Qilin Ransomware in Limited Attacks Since February 2025

Researchers from Microsoft have reported that the North Korea-linked APT group, known as Moonstone Sleet, has been using the Qilin ransomware in limited attacks since February 2025. This APT group, which previously used custom ransomware, has changed tactics by adopting Qilin. The attacks have been observed by Microsoft, which noted this change in the group's attack methods.