| 2013 | Malicious gaming app infecting South Korean smartphones | | North Korea |
| March 25, 2013 | DailyNK, Free North Korea Radio, Nknet, North Korea Intellectuals Society website disrupted | | North Korea (commonly associated) |
| 2014; 2016; last year (2017) | Sony Pictures destructive attack; Bangladesh Bank theft; WannaCry 2.0 | | North Korea; Lazarus Group |
| 10/09/2015 | South Korea | KR | North Korea |
| 05/10/2015 | South Korea | KR | North Korea |
| 05/04/2017 | South Korea and United States | KR US | North Korea |
| 11/09/2017 | South Korea | >1 | North Korea |
| September 2019 | U.S.-based company hack (September 2019) | United States | The North Korea-associated hacker |
| 05/08/2019 | Banks and cryptocurrency exchanges | >1 | North Korea |
| 14/12/2021 | Multiple organizations | >1 | Threat actors originating from China, Iran, North Korea, and Turkey |
| 14/06/2023 | South Korea | KR | North Korea |
| 2023-07-27T05:00:00.000Z | More malicious npm packages found in wake of JumpCloud supply chain hack | | North Korea; Lazarus Group |
| September 2024 | Circle froze USDC in three Ethereum wallets belonging to North Korea or the Lazarus Group | | North Korea; Lazarus Group |
| 2024-04-24T16:43:00+00:00 | Nation-State Threat Actors Renew Publications to npm | | North Korea |
| 2024-11-20T20:03:41+00:00 | North Korean open-source ecosystem attacks (in 2025 Software Supply Chain Security Trends & Predictions) | | North Korea |
| last year (speech delivered 7 May 2025) | North Korea cryptocurrency theft total for the previous year | | North Korea ("it is thought") |
| 06 November 2025 (sanctions date) | Australian sanctions on four entities and one individual engaged in cybercrime for North Korea | | North Korea |
| published 2025-12-18 | North Korean crypto theft in 2025 and 2023 marquee hacks (Atomic Wallet, CoinsPaid, Alphapo, Stake.com, CoinEx) | | North Korea |
| 2025-02-12 (datePublished) | North Korean cryptocurrency theft 2017-2023 (UN estimate cited) | | North Korea |
| 2025-06-12T13:47:04.870Z | Contagious Interview campaign (in 2025 Blockchain and Cryptocurrency Threat Report) | | North Korea |
| 2025-09-09T15:00:00.000Z | Contagious Interview / Ferret macOS malware (in "Ransomware 2025: Infostealers on the March") | | North Korea |
| (published 26 March 2026) | UK sanctions on Xinbi marketplace, which facilitated laundering of crypto assets stolen by North Korea | | North Korea |
| 2026-06-17 (page date) | North Korea cryptocurrency thefts and cybercrimes (general statement, no specific incident named) | | North Korea |
| 12/02/2026 | Multiple organizations | Global | Threat actors from China (APT31, Temp.HEX), Iran (APT42), North Korea (UNC2970), and Russia |
| 2026-04-29 | North Korea IT workers and Lazarus fake job campaigns against the defense industrial base (in "Nation-State Threats Targeting the Defense Industrial Base") | US; UK (infrastructure nodes) | Lazarus; North Korea |
| USDT in wallet addresses traceable to North Korea's laundering of the Bybit exploit proceeds (judgment creditors' motion) | | North Korea |
| Theft of designs and technology (semiconductors, uranium processing, air defense, missiles, SLBM; satellite optical equipment) from the ROK and the UK | Republic of Korea; United Kingdom | North Korea |
| (no date on page) | North Korean ransomware: WannaCry and Maui (in Ransomware as a State-Sponsored Weapon) | UK | Lazarus Group; North Korea |