DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Actor names, as written

Names are listed exactly as sources wrote them. Different spellings and aliases are not merged.

NameEvents
Kimsuky306
Lazarus199
Lazarus Group187
김수키98
Andariel89
APT3770
Labyrinth Chollima69
라자루스68
ScarCruft65
Sapphire Sleet62
Bluenoroff56
Contagious Interview50
HIDDEN COBRA50
Hidden Cobra49
SquidSquad - UNC106948
KONNI47
Reaper46
탈륨39
APT 3734
코니34
Appleworm33
Diamond Sleet fka ZINC33
G003233
Group 7733
Guardians of Peace33
NewRomanic Cyber Army Team33
NICKEL ACADEMY33
Thallium33
Whois Hacking Team33
Ricochet Chollima32
Velvet Chollima32
North Korea28
North Korean IT workers27
DPRK IT workers25
APT3820
conspirators18
hackers18
JON CHANG HYOK18
KIM IL18
PARK JIN HYOK18
금성12118
스모크 스크린18
Unknown17
APT4516
BlueNoroff16
DPRK16
DPRK cyber actors16
Suspected DPRK15
TraderTraitor15
북한15
북한 정찰총국15
정찰총국15
Geumseong12114
Moonstone Sleet14
페이크 스트라이커13
RedEyes12
Chonsurim Trading Corporation IT workers11
InkySquid11
Silent Chollima11
블루 에스티메이트11
DangerousPassword + Adjacent Shit10
Smoke Screen10
Stonefly10
APT439
CryptoCore9
DarkSeoul < Lazarus Group9
Diamond Sleet9
DUSTYDUST9
G01389
Konni9
Lazarus group9
Onyx Sleet fka PLUTONIUM9
Ruby Sleet9
Threat actors from North Korea9
Famous Chollima8
FAMOUS CHOLLIMA8
G00678
Group1238
Jade Sleet8
Red Eyes8
Richochet Chollima8
TA4448
TEMP.Reaper8
UNC48998
Venus 1218
북한 IT 인력8
안다리엘8
Chosun Expo7
DPRK IT Workers7
Fake Striker7
North Korean cyber actors7
North Korean threat actors7
Onyx Sleet7
북한 연계7
Black Banshee6
Emerald Sleet fka THALLIUM6
G00946
Lazarus attack group6
North Korean hackers6
STOLEN PENCIL6
TA-RedAnt6
NGB 3rd Technical Surveillance Bureau5
North Korea-affiliated IT companies in China5
North Korea-linked hackers5
North Korea?5
Park Jin Hyok5
Reconnaissance General Bureau5
Sim Hyon Sop5
WaterPlum5
Attackers from North Korea4
BeagleBoyz4
Citrine Sleet4
Emerald Sleet4
North Korean co-conspirators4
overseas IT workers4
PARK JIN HYOK and co-conspirators4
STARDUST CHOLLIMA4
UNC10694
UNC29704
ZINC4
킴수키4
北朝鮮4
北朝鮮 IT 労働者4
a DPRK IT worker3
and Silent Chollima3
Applejeus3
cyberactors of the DPRK3
Dangerous Interview3
GraphAlgo3
Iran3
Jasper Sleet3
Jon Chang Hyok3
Kejia Wang3
Kim Il3
Lazarus APT3
Lazarus Group and Advanced Persistent Threat 383
Nordkorea3
overseas co-conspirator3
Polin Rider3
Scarcruft3
Storm-17893
TA4063
TA4273
The Lazarus Group3
Trader Traitor3
UNC52673
Yanbian Silverstar3
Zhenxing Wang3
Zinc3
북한 해킹조직3
a DPRK state-sponsored hacking group2
aka Lazarus Group2
APT-C-282
Blue Noroff2
Cerium2
CERIUM2
Chinyong2
CHOE JONG YONG2
Chosun Expo Joint Venture2
COPERNICIUM2
DarkSeoul2
Democratic People’s Republic of Korea cyberactors2
DPRK cyberthreat actor2
DPRK IT2
DPRK operatives2
DPRK threat actors2
DPRK-linked actors2
G00822
Genie Spider < Lazarus Group2
GOLDEN CHOLLIMA2
Group 1232
Hidden Cobra AKA Lazarus Group2
HYON CHOL SONG2
In September 20182
IT Workers2
John Doe aka William James2
Kim Sang Man2
LABYRINTH CHOLLIMA2
Larva-250042
Lazarus APT group2
Lazarus Group AKA Hidden Cobra2
Lazarus Group and APT382
MESSYMESS2
Munitions Industry Department2
Noord-Koreaanse hackers2
Nordkoreanische Nachrichtendienste2
North Korean attackers2
North Korean government2
North Korean state actors2
North Korean state-sponsored threat actors2
PRESSURE CHOLLIMA2
PurpleBravo2
PurpleDelta2
RGB cyber unit known as Andariel2
RIM JONG HYOK and Conspirators2
Ruby Sleet fka CERIUM2
Sapphire Sleet fka COPERNICUM2
Stardust Chollima2
Tenacious Pungsan2
the U.S. Department of Justice2
Threat actor from North Korea2
UNC40342
UNC47362
Volasys Silverstar2
북한 해킹 조직2
북한연계2
블루노로프2
스카크러프트2
ラザルス2
[Unnamed groups: North Korea]1
©2026 Council on Foreign Relations.1
>11
10 Days of Rain1
110th Research Center1
a DPRK cyber actor1
a North Korean actor1
a North Korean citizen1
a North Korean cyber actor1
a North Korean group like the Lazarus Group1
a North Korean IT worker1
A threat group with a nexus to North Korea1
a.k.a. Emerald Sleet1
a.k.a. Hidden Cobra1
About1
All DPRK malicious cyber groups1
All rights reserved.1
alleged members of this threat actor.1
also known as the Lazarus Group1
also Storm-1877 and Moonstone Sleet1
Amnokgang Technology Development Company1
an actor tied to North Korea1
An Chung Yol1
an IT worker team1
and1
and Kimsuky1
and North Korea1
and Russia1
and STARDUST CHOLLIMA1
and Stonefly1
and Turkey1
Andariel Group1
announced1
AppleJeus1
Applejues1
APT-C-261
APT-Gruppierung Lazarus1
APT45 a.k.a. Andariel1
ARCHIPELAGO1
attackers from Iran and North Korea1
Audricus Phagnasay1
Believed to be associated with the North Korean government1
Believed to be the work of the North Korean government1
Blockbuster1
Bong Chee Shen persona1
Bureau 3251
CageyChameleon1
Careers1
Chang Nam Il1
CHANG NAM IL1
Chang Nam Il charged1
Cheng Hung Man1
China1
China-linked threat groups1
Chinese laundering syndicate1
ChinopuNK1
Chinyong Information Technology Cooperation Company1
CHO CHUNG POM1
Choe Kum Song1
Chonsurim Trading Corporation1
Chunji Jin1
CIA1
Clasiopa1
CloudDragon1
Contact1
Contagious Interview?1
Contagious Interview.1
Contagious Interviews campaign1
Coral Sleet1
Covellite1
criminally charged and sanctioned1
CryptoMimic actors1
cyberactors associated with Kimsuky1
cyberactors of the Democratic People's Republic of Korea1
Dalian Shepherd Boy Animation Studio1
Dangerous Password1
dangrouspassword1
Dark Seoul1
DarkSeoul attack group1
DeathNote cluster of the Lazarus group1
Democratic People’s Republic of Korea1
Democratic People’s Republic of Korea actors1
Democratic People's Republic of Korea cyber actors1
Democratic People’s Republic of Korea cyberthreat actors1
Democratic People’s Republic of Korea hackers1
Department 53 of the Ministry of the People's Armed Forces1
DEV-01391
DEV-02151
DEV-05301
did not attribute the activity to a named threat actor1
DIDENKO and customers1
DPRK adversaries1
DPRK cyber hackers1
DPRK cyber threat actors1
DPRK government1
DPRK hackers1
DPRK IT worker cluster1
DPRK IT Workers + Theft1
DPRK programmer1
DPRK remote worker1
DPRK remote worker program1
DPRK Ryugyong Technology Company1
DPRK state-linked cyber actors1
DPRK state-sponsored cyber threat actors1
DPRK state-sponsored threat actor1
DPRK-affiliated actors1
DPRK-affiliated groups1
DPRK-aligned attackers1
DPRK-aligned operators1
DPRK-linked Contagious Interview campaign1
DPRK-linked Contagious Interview operation1
DPRK-linked fake IT workers1
DPRK-linked hackers1
DPRK-nexus actors1
DPRK-nexus groups1
EMANUEL ASHTOR1
ERICK NTEKEREZE PRINCE1
Espionage1
észak-koreai hackertámadás1
Facebook1
facilitator for Amnokgang and Ryugyong IT workers1
facilitator for DPRK IT workers1
facilitators for DPRK IT workers1
fake North Korean IT workers1
First Credit Bank1
Footer1
For Media1
fraudulent North Korean IT workers1
General Bureau of Reconnaissance1
government-backed entity based in North Korea1
government-linked hackers from China1
groups aligned with North Korean objectives1
Gunra1
Gwisin group1
Gyeongheung1
hackers associated with the DPRK government1
Hackers from North Korea1
Hackers linked to North Korea1
Hackers tied to North Korea1
Han Kwang Hyok1
Haoran Xu1
HIDDEN COBRA AKA The Lazarus Group AKA APT381
Ho Jong Son1
Huang Jingbin1
in addition to other DPRK actor groups1
Instagram1
Is One1
IT workers1
James Willy1
Jammy Chen1
JANG CHOL MYONG1
Jang Kuk Chol1
Jason Salazar1
Jiho Han1
JIN SUNG-IL1
JINX-0164 UNC68361
Jo Kyong Hun1
John Doe1
John Does 1-21
Jong Pong Ju1
JONG PONG JU1
JONG SONG HWA1
JumpCloud traced to Lazarus subgroup Labyrinth Chollima1
Kang Tae Bok1
KANG TAE BOK1
Kim Kwang Jin1
KIM KWANG JIN1
KIM MU RIM and co-defendants1
KIM RYU SONG1
Kim Se Un1
KIM YE WON1
KimJongRAT1
KIMSUKY1
Kimsuky (aka Emerald Sleet or Velvet Chollima1
Kimsuky | VelvetChollima1
Kimsuky a.k.a. Black Banshee1
Kimsuky advanced persistent threat group1
Kimsuky AKA TA4061
Kimsuky AKA Thallium1
Kimsuky and Andariel1
Kimsuky and Group1231
Kimsuky and Konni1
Kimsuky APT group1
Kimsuky Group1
Kimsuky or Smoke Screen1
Kimsuky overlaps1
Kimsuky umbrella1
Kimsuky-like1
Kimsuky” Operation1
Kimusky1
KO CHUNG SOK1
Konni Group1
Korea1
Korea Mangyongdae Computer Technology Corporation IT workers1
Korea Sinjin Trading Corporation1
Korea Sobaeksu Trading Company1
Kyonghung Information Technology Exchange Company1
Larva-240051
Larva-250101
Larva-260051
later attributed to Lazarus1
LAZARUS1
Lazarus | SilentChollima1
Lazarus Advanced Persistent Threat Group1
Lazarus DeceptiveDevelopment cluster1
Lazarus Group actors1
Lazarus Group AKA APT381
Lazarus Group AKA HIDDEN COBRA1
Lazarus Group AKA Labyrinth Collima1
Lazarus Group named in statement1
Lazarus Resurfaces1
Lazarus subgroup1
Lazarus-attributed activity1
Lazarus-Gruppe1
Li Jiadong1
likely North Korean state-sponsored attackers1
likely North Korean threat actor1
likely orchestrated by North Korean hackers1
LinkedIn1
Logo1
Ltd1
malicious cyber actors1
malware analysis report1
Member Programs1
Membership1
MIDNIGHT NEPTUNE1
Minh Phuong Ngoc Vong1
MOA réputé lié à la Corée du Nord Moonstone Sleet1
MOA réputé lié aux intérêts nord-coréens Kimsuky1
MOA réputés nord-coréens1
MOONSTONE SLEET1
multiple North Korean groups1
Multiple threat actors from North Korea1
Myong Chol Min1
New Romanic Cyber Army Team1
Newsletters1
Nickel Academy)1
NICKEL TAPESTRY1
Noord-Korea1
Noord-Koreaanse freelance IT’ers1
Noord-Koreaanse IT’ers1
North Korea IT workers1
North Korea linked activity1
North Korea-affiliated cybercriminals1
North Korea-backed hackers1
North Korea-linked1
North Korea-linked PolinRider1
North Korea's cyber-espionage campaign1
North Korea’s General Reconnaissance Bureau1
North Korea’s Lazarus Group1
North Korean1
North Korean actors1
North Korean Actors1
North Korean Advanced Persistent Threat groups1
North Korean APT groups1
North Korean cyberattack1
North Korean cybercrime syndicates1
North Korean government threat actors1
North Korean government-backed entity1
North Korean group1
North Korean group PurpleBravo1
North Korean hacker units1
North Korean hacking group1
North Korean intelligence services1
North Korean IT contractors1
North Korean IT operatives1
North Korean IT worker1
North Korean IT workers based in China1
North Korean Lazarus Group1
North Korean Lazarus subgroup1
North Korean malicious cyber actors1
North Korean nation-state actors1
North Korean operators1
North Korean remote IT workers1
North Korean state-affiliated actors1
North Korean state-sponsored actors1
North Korean state-sponsored efforts1
North Korean state-sponsored groups1
North Korean threat actor1
North Korean worker1
North Korean-perpetrated1
not attributed to a specific DPRK actor1
offshoot of the Lazarus threat group1
Oleksandr Didenko1
on a tool called Typeframe used by the Lazarus Group.1
OnionDog1
Opal Sleet1
Opal Sleet fka OSMIUM < Kimsuky1
Operation Dream Job and Operation AppleJeus1
Operation Earth Kitsune1
Operation Troy1
OSMIUM1
overlaps Kimsuky1
overlaps with APT43 and TEMP.Hermit1
PAEKTUSAN1
PAK JIN-SONG1
Park Jin-hyok and Chosun Expo Joint Venture1
Pearl Sleet1
PEDRO ERNESTO ALONSO DE LOS REYES1
PolinRider1
possibly DPRK IT workers1
Privacy Policy1
Private sector1
probable DPRK IT workers1
probably belonging to the Kimsuky Group1
probably Kimsuky1
PRONTO1
PUKCHONG a.k.a. UNC4899)1
puNK-0031
puNK-0121
Read more1
RGB1
RI KYONG SIK1
RICOCHET CHOLLIMA1
Rim Jong Hyok1
Rim Jong Hyok and RGB co-conspirators1
RIM UN CHOL1
RubySleet1
Sandworm1
Sangsin IT delegation1
SANS FAB1
ScarCruft and Lazarus1
ScarCruft and the Lazarus Group1
SharpTongue1
Shenyang Geumpungri Network Technology Co.1
SILENT CHOLLIMA1
Sim Hyon Sop network1
Slow Pisces1
SOK KWANG HYOK1
Song Kum Hyok1
Song Rim1
South Korean Citizen1
SQSQ1
SquidSquad1
state-sponsored North Korean hackers1
State-sponsored North Korean threat actors1
Stressed Pungsan1
Sun Team1
Support1
suspected DPRK1
Suspected DPRK group1
suspected DPRK IT worker1
suspected DPRK IT workers1
suspected North Korean IT worker1
suspected North Korean operators1
suspected North Korean-linked1
Suspected state sponsor1
TA406” and “TA4271
TA4081
TA444 aka BlueNoroff1
TAG-1211
TAG-711
Target category1
Targets Global Banks and Bitcoin Users1
Temp.Hermit1
TEMP.Hermit1
Terms of Use1
THALLIUM1
THALLIUM or Kimsuky.1
The Lazarus Group AKA HIDDEN COBRA1
The Lazarus Group and BlueNoroff1
the Lazarus Group or a related organization1
the North1
The North Korea-associated hacker1
the North Korean hacker group Lazarus Group1
The North Korean threat actor1
threat actor operating on behalf of North Korea1
Threat actors from China1
threat actors linked to North Korea1
Threat actors originating from China1
Tian Yinyin1
Tonto Team1
TraderTraitor - Jade Sleet1
Type of incident1
UAT-53941
UAT-5394 linked to Kimsuky1
Umnal delegation1
Unattributed state-sponsored group1
UNC37821
UNC53421
UNC577 < Lazarus Group1
undercover DPRK IT worker1
UNK_DeadDrop1
unverified link to Andariel1
UTA00401
Vedalia1
VELVET CHOLLIMA1
Void Dokkaebi1
Wagemole1
wahrscheinlich verantwortlich für Lazarus1
which is also called Hidden Cobra1
WHOis Team1
Wu Huihui1
YouTube1
Yuan Ziyou and others1
Yun Song Guk1
Zhonghua1
라자루스 and 안다리엘1
레드아이즈1
북한 313총국1
북한 소행1
북한 소행일 가능성1
북한 체신성1
북한 추정1
북한 추정 해커 세력1
북한 해킹조직 ... '김수키'와 연관1
정찰총국 소속 해커1
北朝鮮IT 労働者1
北朝鮮のAPT攻撃グループ1