DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

APT43 (9)

Events whose actors field, as written by the source, names this.

Date (as written)IncidentCountryActors
(reporting period 2023-2024)Kimsuky social engineering against German research, public administration, legal advice and education sectorsGermanyAPT43 / Velvet Chollima / Kimsuky / Emerald Sleet
2023-03-28 (datePublished)APT43 espionage and cryptocurrency theft to fund operationsSouth Korea, Japan, Europe, and the United StatesAPT43 (Kimsuky)
02/05/2024Multiple organizations>1APT43 (a.k.a. Kimsuky, Emerald Sleet, Velvet Chollima, and Black Banshee)
22/04/2024Multiple organizations in South KoreaKRTA427, a.k.a. Emerald Sleet, APT43, THALLIUM or Kimsuky.
2024-10-02[VirusBulletin 2024] Go-ing Arsenal: A Closer Look at Kimsuky’s Go Strategic AdvancementAPT43; Kimsuky
M-Trends 2024 (report year; no day-level date on PDF)APT43 profileSouth Korea; United StatesAPT43 (North Korean Government)
2025-09-112025년 8월 APT 그룹 동향 보고서APT43; Kimsuky; Lazarus
2026-02-132026년 1월 APT 그룹 동향 보고서APT43; Andariel; KONNI; Kimsuky; Konni; Lazarus
2026-02-10 (datePublished)Suspected APT43 infrastructure mimicking German and U.S. defense-related entities (THINWAVE)German and U.S.APT43 (suspected)