| 2014 | Japan case 1: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| 2020 | Japan case 2: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| (seizures March, June, August and September 2022) | North Korean IT worker money laundering network: IT worker payments laundered and sent back via Sim Hyon Sop (FTB) and Kim Sang Man (Chinyong / Jinyong IT Cooperation Company) | | North Korean IT workers; Sim Hyon Sop; Kim Sang Man; Chinyong (Jinyong IT Cooperation Company) |
| Over a roughly three-year period (hosting laptops since at least 2022; searches October 10, 2024) | Zhenxing Wang / Kejia Wang New Jersey laptop farms supporting North Korean IT workers at more than 100 U.S. companies | U.S. (New Jersey) | North Korean IT workers; Zhenxing Wang; Kejia Wang |
| JAN 19 2023 (application) | Seizure of approximately $397,674.32 in 35 money-transfer accounts holding proceeds of North Korean IT worker fraud scheme (Yanbian Silverstar) | China (withdrawals to bank accounts in China) | North Korean IT workers; Yanbian Silverstar |
| 2023-04-24 | IT workers at U.S. blockchain development companies laundering earnings via Sim | United States | Sim Hyon Sop; North Korean IT workers |
| since at least Dec ember 2024 | Spotlight: Uncovered Russia-based North Korean IT Worker Cell | Russia | North Korean IT workers |
| March 15, 2024 | Theft from Company 1 by a developer later determined to be a North Korean IT worker (exploit of master smart contract) | | North Korean IT workers; North Korean actors |
| in or around August 2024 | Theft from Company 1 (U.S.-based, headquartered in New York) linked to IT worker persona Bong Chee Shen | U.S. (New York) | North Korean IT workers; Bong Chee Shen persona (used by Chang Nam Il, a North Korean citizen) |
| 2024 | Japan case 3: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| 2024 | Japan case 4: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| 2024-11-22T11:00:00+00:00 (published_time) | North Korean IT workers (repository found October 2024) | operating out of North Korea, Russia, and China | North Korean IT workers |
| October 2025 | Slack chat groups of North Korean IT workers: collection officer specifying crypto addresses | | North Korean IT workers |
| In recent months (as of 2025-01-23) | IT workers extorting employers with stolen data and code | United States | North Korean IT workers |
| 2025-06-05 | IT workers at blockchain development companies; $7.74 million frozen | | North Korean IT workers; Sim Hyon Sop; Kim Sang Man (Chinyong) |
| 2025-07-23 | IT workers using witting and unwitting U.S.-based facilitators | United States | North Korean IT workers |
| August 27, 2025 | North Korean IT workers involved in malicious cyber activities, particularly in the blockchain industry | | North Korean IT workers |
| 2025 | Japan case 5: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| Microsoft Digital Defense Report 2025 | North Korean remote IT workers embedded at organizations worldwide | around the world; US-based companies | North Korean IT workers (Jasper Sleet) |
| 2025-03-06 (datePublished) | North Korean IT workers: global expansion, extortion and data leak operations | U.S.; Europe and Asia | North Korean IT workers |
| 2025-09-18T05:00:00.000Z | North Korean IT worker schemes (in "How Malicious Hackers Try to Infiltrate Your IT Team") | China; Russia (where operatives often work from); US (identities) | North Korean IT workers |
| (as of September 18, 2026) | First laptop farm dismantled in Japan | Japan | North Korean IT workers; WaterPlum |
| July 31, 2026 | North Korean IT workers: insider threat, data exfiltration, cryptocurrency theft | | North Korean IT workers |
| January 12, 2026 | Unmasking the DPRK Remote Worker Problem | | DPRK remote worker program; North Korean IT workers |
| North Korean IT workers employed by DeFi Company 1, a U.S.-based IT development company (IT Worker-1 posing as Palmer; IT Worker-2 posing as Bram Chen) | U.S. | North Korean IT workers |
| North Korean IT worker ("Alex Hong") employed by DeFi Company 2, based in the U.S., to create a DApp | U.S. | North Korean IT workers |
| (not dated) | IT worker extortion with published source code; IT worker website defacement | | North Korean IT workers |