Labyrinth Chollima (69)
Events whose actors field, as written by the source, names this.
| Date (as written) | Incident | Country | Actors |
|---|---|---|---|
| 2007 | Operation “Flame” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2013-05 | South Korean Financial Companies Targeted by Castov | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 01.10.2015 | North Korean Lazarus group conducts operations against banks in Vietnam and the Philippines starting in October 2015 | Philippines | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Reconnaissance General Bureau |
| 2017-08 | The Blockbuster Saga Continues | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 01.09.2017 | North Korean Lazarus group conducts Operation Sharpshooter against organziations in global defense and critical infrastructure since September 2017 | United States;United States;United States;United States | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.04.2017 | Lazarus (NorthKorea) attacks endusers because of financial interests | Unknown;Unknown | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2017 | Lazarus Bitcoin Hijack | Korea, Republic of | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Reconnaissance General Bureau |
| 2017 Late | Several financial sector and a casino breaches using KillDisk wiping malware in Latin America and USA. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2017/2018 | Cryptocurrency attacks on South Korean exchanges. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2018-04 | Operation “GhostSecret” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 01.06.2018 | Andariel Group attacks website of South Korean non-profit organisation | Korea, Republic of;Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2018-04 | The first artefacts we found relating to MATA were used around April 2018. After that, the actor behind this advanced malware framework used it aggressively to infiltrate corporate entities around the world. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2018-01 | F-Secure’s investigation revealed that a system administrator from the target organization received a phishing document via their personal LinkedIn account. The document masqueraded as a legitimate job advert for a role in a blockchain technology company that matched the employee’s skills. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2018-08 | Operation “AppleJeus” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2018-07 | Operation “CryptoCore” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2018-11 | More Attacks on Cryptocurrency Businesses | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 01.01.2019 | Lazarus turns against Russia | Russia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.09.2019 | Operation In(ter)ception | Europe (region);Middle East (region) | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2019-05 | Hackers associated with the APT Lazarus/HIDDEN COBRA group were found to be breaking into online stores of large US retailers and planting payment skimmers as early as May 2019. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2019-09 | Lazarus Group’s MATA Framework Leveraged to Deploy TFlower Ransomware | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 01.01.2020 | ThreatNeedle: Defense Industries | Unknown | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2021 | State-sponsored North Korean hacking group Lazarus deployed newly discovered backdoor WinorDLL64 against unspecified South Korean targets since 2021 | Korea, Republic of | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.10.2021 | North Korean state-sponsored hacker group Lazarus gained access to the corporate network of an aerospace company in the Netherlands in October 2021 | Netherlands | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.11.2021 | BlueNoroff hackers steal crypto using fake MetaMask extension | United States;Russia;China;India;United Kingdom;Ukraine;Poland;Czech Republic;United Arab Emirates;Germany | Blue Noroff/APT38/Stardust Chollima/G0082/Sapphire Sleet fka COPERNICUM/Genie Spider < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.05.2021 | DeathNote cluster | Korea, Republic of;Korea, Republic of;Latvia;Latvia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-03 | Lazarus Attack Activities Targeting Japan (VSingle/ValeforBeta) | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2021-06 | APT actor Lazarus attacks defense industry, develops supply chain attack capabilities | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-02 | On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 01.10.2022 | North Korean state-sponsored APT Andariel stole data from unnamed South Korean defence manufacturer through accessing maintenance/repair partner, starting in October 2022 | Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 22.12.2022 | State-sponsored North Korean hacker group Andariel stole sensitive information from South Korean defense companies as well as research institutes and pharmaceutical companies since at least 22 December 2022 | Korea, Republic of;Not available;Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.07.2022 | North Korean State-Sponsored Hacking Group Lazarus Compromised Unnamed Software Vendor Starting In Mid-2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2022 | North Korean state-sponsored hacking group 'Lazarus' gained access to network of unspecified Spanish aerospace company beginning in 2022 | Spain | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.11.2022 | North Korean state-sponsored APT groups 'Ruby Sleet' and 'Diamond Sleet' compromised two arms manufacturers in Germany and Israel beginning in November 2022 | Israel;Germany | Ruby Sleet fka CERIUM;Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.07.2022 | The North Korean state-sponsored hacking group Lazarus gained access into the networks of a defence contractor in Africa and stole data using the DeathNote malware beginning in July 2022 | Africa | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.06.2022 | North Korean state-sponsored hacking group UNC2970 targeted US and European media and technology companies since at least June 2022 | Europe (region);Europe (region);United States;United States | TEMP.Hermit/ UNC577 < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Lab 110) |
| 21.10.2022 | North Korean state-sponsored hacking group Lazarus gained access to two computers at a financial organisation beginning on 21 October 2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.05.2022 | North Korean state-sponsored hacking group Lazarus gained access to the network of a financial organisation in May 2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 02.09.2022 | Financially-motivated hacker group BlueNoroff compromised a company employee in the United Arab Emirates beginning in September 2022 | United Arab Emirates | Blue Noroff/APT38/Stardust Chollima/G0082/Sapphire Sleet fka COPERNICUM/Genie Spider < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.02.2022 | Between February and July 2022, the North Korean group Lazarus targeted organizations, including energy service providers worldwide | Global (region);Canada;United States;Japan | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2022-01 | North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-02 | Operation “LolZarus” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022 Early | Tracing State-Aligned Activity Targeting Journalists, Media | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-06 | ₿uyer ₿eware: Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-08 | deBridge Finance crypto platform targeted by Lazarus hackers | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-08 | Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022-09 | SlowMist: Investigation of North Korean APT’s Large-Scale Phishing Attack on NFT Users | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2022 Late | North Korean hackers linked to defense sector supply-chain attack | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 01.08.2023 | North Korean State-Sponsored Hacker Group Lazarus Exploited Windows Zero-Day Vulnerability in Admin-to-Kernel Operation going back to at least August 2023 | Asia (region);Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.10.2023 | North Korean state-sponsored hacking group Diamond Sleet compromised vulnerable TeamCity servers since early October 2023 | Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2023 | North Korean state-sponsored APT group 'Diamond Sleet' compromised defence companies in several countries in January 2023 | Norway;Finland;Italy;Brazil;Poland;Czech Republic | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.03.2023 | North Korean APT group 'Onyx Sleet' targeted Russian University in March 2023 | Russia;Russia | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2023 | North Korean state-sponsored hacking group Labyrinth Chollima gained access to network of unnamed Latin American banking company using QRLOG malware beginning in January 2023 | South America;Central America (region) | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-07 | Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| Not available | Lazarus Group targeted Windows IIS Web Servers in Global Campaign | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-06 | Lazarus Threat Group Exploiting Vulnerability of Korean Finance Security Solution | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2023-10 | Operation “Dream Magic” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2023-10 | Elastic catches DPRK passing out KANDYKORN | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| (reporting period 2023-2024) | Lazarus job-offer document attacks on German IT services, weapons/ammunition and aerospace sectors | Germany | Labyrinth Chollima / Lazarus / Diamond Sleet |
| 2023-09-05T05:00:00.000Z | VMConnect PyPI campaign (in "Threat research roundup: Lessons learned from recent PyPI and npm supply chain attacks") | Lazarus; Labyrinth Chollima | |
| 01.08.2024 | North Korean state-sponsored hacking group Stonefly launched an attack on US companies in August 2024 | United States | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.04.2024 | North Korean APT Group Andariel targeted South Korean construction and machinery companies in April 2024 | Korea, Republic of;Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 05.01.2024 | Lazarus Group suspected of having drained $7.5 million from crypto payment service provider CoinsPaid on 5 January 2024 | Estonia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2024-02 | Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2024-05 | The Crypto Game of Lazarus APT: Investors vs. Zero-days | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2024-11 | Operation “SyncHole” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2025-01 | Operation “99” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2025-01 | Operation “Phantom Circuit” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| 2025-01 | Operation “Marstech Mayhem” | Lazarus Group, Hidden Cobra, Labyrinth Chollima | |
| Not available | North Korean state-integrated hacking group Lazarus gained access to networks of defence and maritime companies | Not available;Not available;Hungary | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |