| 2007 | Operation “Flame” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2013-05 | South Korean Financial Companies Targeted by Castov | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-10 | FASTCash | ZZZ | Hidden Cobra |
| 2017-08 | The Blockbuster Saga Continues | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2017 Late | Several financial sector and a casino breaches using KillDisk wiping malware in Latin America and USA. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2017/2018 | Cryptocurrency attacks on South Korean exchanges. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-12 | RedBanc | Chile | Hidden Cobra |
| 2018-10 | BankIslami | Pakistan | Hidden Cobra |
| 2018-04 | Operation “GhostSecret” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| March 2018 | CSIS entry 867 | | |
| 2018-04 | The first artefacts we found relating to MATA were used around April 2018. After that, the actor behind this advanced malware framework used it aggressively to infiltrate corporate entities around the world. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-01 | F-Secure’s investigation revealed that a system administrator from the target organization received a phishing document via their personal LinkedIn account. The document masqueraded as a legitimate job advert for a role in a blockchain technology company that matched the employee’s skills. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-08 | Operation “AppleJeus” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-07 | Operation “CryptoCore” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-11 | More Attacks on Cryptocurrency Businesses | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| August 6, 2018 | Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families (DarkSeoul, Operation Troy, 10 Days of Rain, WannaCry) | | Lazarus, Silent Chollima, Group 123, Hidden Cobra, DarkSeoul, Blockbuster, Operation Troy, 10 Days of Rain |
| 29/05/2018 | Multiple Targets | US | Hidden Cobra |
| 06/02/2018 | Multiple Targets | >1 | Hidden Cobra, aka Lazarus Group |
| 12/02/2018 | Bitcoin users and global financial organizations. | >1 | Hidden Cobra, aka Lazarus Group |
| 14/06/2018 | Multiple Targets | US | Hidden Cobra |
| 09/08/2018 | US Organizations | US | Hidden Cobra |
| January 2019 | CSIS entry 760 | | |
| 2019-05 | Hackers associated with the APT Lazarus/HIDDEN COBRA group were found to be breaking into online stores of large US retailers and planting payment skimmers as early as May 2019. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2019-09 | Lazarus Group’s MATA Framework Leveraged to Deploy TFlower Ransomware | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| Jul 29, 2020 | Operation (North Star) North Star: A Job Offer That's Too Good to be True? | | Hidden Cobra |
| 2021-03 | Lazarus Attack Activities Targeting Japan (VSingle/ValeforBeta) | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2021-06 | APT actor Lazarus attacks defense industry, develops supply chain attack capabilities | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2021-02-03 | 攻撃グループ「Lazarus」のマルウェア情報を公開 - JPCERT/CC | | Lazarus; Hidden Cobra |
| 2022-02 | On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-01 | North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-02 | Operation “LolZarus” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022 Early | Tracing State-Aligned Activity Targeting Journalists, Media | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-06 | ₿uyer ₿eware: Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-08 | deBridge Finance crypto platform targeted by Lazarus hackers | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-08 | Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-09 | SlowMist: Investigation of North Korean APT’s Large-Scale Phishing Attack on NFT Users | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022 Late | North Korean hackers linked to defense sector supply-chain attack | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-07 | Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-06 | Lazarus Threat Group Exploiting Vulnerability of Korean Finance Security Solution | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-10 | Operation “Dream Magic” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-10 | Elastic catches DPRK passing out KANDYKORN | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2024-02 | Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2024-05 | The Crypto Game of Lazarus APT: Investors vs. Zero-days | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2024-11 | Operation “SyncHole” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-01 | Operation “99” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-01 | Operation “Phantom Circuit” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-01 | Operation “Marstech Mayhem” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 01/01/1970 | Targets in the US | US | Hidden Cobra (AKA Lazarus Group) |
| 01/01/1970 | US and western financial institutions | >1 | Hidden Cobra |