Threat Intelligence Tarot
Vol. II · 95
North Korea (RGB)
★★★★★
risk 3/5
✦ The Pale Deceiver ✦
Moonstone Sleet
Storm-1789
DefenseAerospaceEducationIT sectorCryptocurrency
Active since ~2023 · Revenue generation, Espionage, Defense IP theft
The Pale Deceiver builds entire companies to approach its targets, staffing them with ghosts and directing them toward aerospace and defense. Its most innovative weapon is not malware but identity, worn like a suit.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆FakePenny ransomware deployment against defense and aerospace targets
- ◆Fake IT companies (StarC, DeTankZone) used as cover for social engineering
- ◆Trojanized PuTTY and tank game used as malware delivery vehicles
- ◆IT worker infiltration scheme placing North Koreans at Western tech firms
Defenses
- ▸Enhanced background verification for all remote IT contractorsNIST CSF: PR.AT ↗
- ▸Code signing certificate validation and revocation monitoringCIS Control 10 ↗
- ▸Allowlisting of approved software preventing unsigned executable executionCIS Control 10 ↗
- ▸Insider threat program monitoring unusual data access patternsNIST CSF: DE.CM ↗
Reversed: Their Weakness
Background screening processes and identity verification for remote contractors expose the hollow companies behind its infiltration scheme. Code signing certificate validation removes its masquerading cover.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.