Onyx Sleet uses array of malware to gather intelligence for North Korea

Microsoft Threat Intelligence attributes sustained espionage and some financially-motivated operations to Onyx Sleet (North Korean-linked), documenting its evolution from spear-phishing to exploiting N-day vulnerabilities, use of custom RATs and ransomware (TigerRAT, SmallTiger, LightHand, ValidAlpha), observed campaigns targeting defense, energy, and technology sectors (notably in India, South Korea, and the U.S.), published IOCs (IPs, domains, SHA-256 hashes, fake Tableau certificate), and recommended mitigations and detection queries for defenders.