| Since September 2021 | Sim Hyon Sop receiving IT-worker and stolen-crypto funds | | Sim Hyon Sop (KKBC); DPRK IT workers |
| as recently as 2021 | IT teams in China and Russia remitting cryptocurrency (Kim Sang Man / Chinyong) | | Chinyong Information Technology Cooperation Company; DPRK IT workers |
| From approximately 2021 until October 2024 | Kejia Wang / Zhenxing Wang laptop-farm IT worker scheme (100+ U.S. companies) | United States | DPRK IT workers |
| since the release of the 2022 advisories | DPRK IT worker scheme (updated tradecraft) | | DPRK IT workers |
| May 16, 2022 | DPRK IT workers dispatched worldwide (PRC and Russia primarily) | | DPRK IT workers |
| 2023 | IT workers building or exploiting vulnerabilities in platforms and smart contracts; suspected smaller cryptocurrency heists; fake-identity employment | | DPRK IT workers |
| 2024-01-25 | Wall Street Memes | | |
| 2024-03-05 | MurAll | | |
| 2024-03-13 | CloudAI | | |
| 2024-05-22 | Exclusible Penthouse | | |
| 2024-05-29 | SpaceCatch | | |
| 2024-09-26 | Onyx DAO | | DPRK IT workers |
| 2024-11-11 | DeltaPrime | | DPRK IT workers |
| (advisory reference 0924; September 2024) | DPRK IT workers targeting UK firms disguised as freelance third-country IT workers | United Kingdom | DPRK IT workers |
| 2024 | Cryptocurrency thefts by DPRK IT workers (OnyxDAO, Exclusible Penthouse, BTCTurk) | | DPRK IT workers (according to one private sector partner) |
| Throughout 2024 | IT workers using 12 personas via recruitment agencies at European defense subcontractors | Europe | DPRK IT workers (per Mandiant) |
| since late October 2024 | Extortion by fired IT workers threatening to release former employers’ data | | DPRK IT workers (per Mandiant) |
| 2024 and 2025 | Animation work under false identities (HBO Max, Amazon, Japanese studios) – Dalian Shepherd Boy Animation Studio | China | DPRK IT workers / Dalian Shepherd Boy Animation Studio |
| January 2024 - September 2025 (reporting period) | IT workers’ fake job offer compromise of an employee computer at a defense company | | DPRK IT workers |
| April 2025 | CSIS entry 71 | | |
| 2025-09-25 (article) | At least 25 instances of North Korean IT workers infiltrating crypto companies to steal funds or extort; five IT workers with 30+ fake identities; Blocknovas LLC and Softglide LLC fronts | | DPRK IT workers (ZachXBT) |
| Jul 2 (year 2025 inferred from thread text 'since January 1, 2025'; page shows 'Jul 2') | ZachXBT: payments to North Korean IT workers hired as developers since January 1, 2025 | | DPRK IT workers |
| 2025-04-01 (datePublished) | DPRK IT worker operations expanding to Europe (one worker with 12 personas targeting defense and government) | Europe and the United States; United Kingdom; Germany and Portugal | DPRK IT workers |
| 2025-04-01 (datePublished) | DPRK IT worker extortion attempts against larger organizations (since late October 2024) | | DPRK IT workers |
| IT worker projects in the United Kingdom (e.g. Nodexa token hosting platform) | United Kingdom | DPRK IT workers (per Mandiant) |