North Korean cybercriminals have started deploying malware developed by a Russia-linked group in their recent extortion campaigns, seemingly marking the first time they have turned to an operator that supplies such tools to third parties.

Microsoft Threat Intelligence reported on social media on Friday that it has observed the North Korean group Moonstone Sleet using the Qilin malware, developed by a Russian-speaking group of the same name, since February.

“Moonstone Sleet has previously exclusively deployed their own custom ransomware in their attacks, and this represents the first instance they are deploying ransomware developed by a