| publication date not shown on page (covers activity since June 2023) | Ruby Sleet and Onyx Sleet targeting aerospace and defense organizations | United States and South Korea | Ruby Sleet; Onyx Sleet |
| publication date not shown on page (covers activity since June 2023) | Ruby Sleet backdoored installer of a South Korean electronic document program (December 2023) | South Korean | Ruby Sleet |
| Microsoft Digital Defense Report 2023 | Ruby Sleet use of a stolen IT security solutions provider certificate (early 2023) | | Ruby Sleet |
| Microsoft Digital Defense Report 2023 | Ruby Sleet fake LinkedIn profiles targeting a defense company and cybersecurity company in Israel | Israel | Ruby Sleet |
| Microsoft Digital Defense Report 2023 | Ruby Sleet, Diamond Sleet, and Sapphire Sleet targeting maritime and shipbuilding sector (November 2022 to January 2023) | | Ruby Sleet; Diamond Sleet; Sapphire Sleet |
| Microsoft Digital Defense Report 2023 | Ruby Sleet and Diamond Sleet compromise of two arms manufacturing companies in Germany and Israel (November 2022 to January 2023) | Germany and Israel | Ruby Sleet; Diamond Sleet |
| Microsoft Digital Defense Report 2023 | Ruby Sleet, Onyx Sleet and Opal Sleet targeting Russian aerospace institute, university, and diplomatic entities (March 2023) | Russian | Ruby Sleet; Onyx Sleet; Opal Sleet (likely) |
| 22/11/2024 | Aerospace and defense companies | >1 | Ruby Sleet |
| 2024-11-22T11:00:00+00:00 (published_time) | Ruby Sleet supply chain attack on a Korean construction company (VeraPort) and aerospace/defense compromises | Korean | Ruby Sleet |