| 2023-05 | North Korea Using Social Engineering to Enable Hacking of Think Tanks, Academia, and Media | | Kimsuky, Velvet Chollima |
| 01.01.2013 | Operation“Kimsuky” | Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;China;China;China;China | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2018-03 | Operation “Baby Coin” | | Kimsuky, Velvet Chollima |
| 2018-10 | Operation “Mystery Baby” | | Kimsuky, Velvet Chollima |
| February 2019 | CSIS entry 752 | | |
| 2019-01 | Operation “Kabar Cobra” | | Kimsuky, Velvet Chollima |
| 2019-04 | Operation “Stealth Power” | | Kimsuky, Velvet Chollima |
| 2019-04 | Operation “Smoke Screen” | | Kimsuky, Velvet Chollima |
| 2019-07 | Operation “Red Salt” | | Kimsuky, Velvet Chollima |
| 2020-03 | According to a tweet shared by South Korean cyber-security firm IssueMakersLab, a group of North Korean hackers also hid malware inside documents detailing South Korea's response to the COVID-19 epidemic. | | Kimsuky, Velvet Chollima |
| 01.06.2021 | Kimsuky vs. South Korean think tanks | Korea, Republic of | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 01.12.2022 | North Korean state-sponsored hacking group Kimsuky targeted the staff of consulting firm Korea Risk Group (KRG) and other organizations in the United States, Europe and Asia since December 2022 | Korea, Republic of;Asia (region);Asia (region);Europe (region);Europe (region);United States;United States | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2022-04 | Operation “Covert Stalker” | | Kimsuky, Velvet Chollima |
| 01.04.2023 | North Korean state-sponsored APT Kimsuky stole technical data from unnamed South Korean defence company via email hack from April to July 2023 | Korea, Republic of | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2023-11 | Kimsuky Targets South Korean Research Institutes with Fake Import Declaration | | Kimsuky, Velvet Chollima |
| 01.05.2023 | North Korean state-sponsored hacking group Kimsuky stole documents from unspecified victims in May 2023 | Not available | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2023-03 | North Korean APT group ‘Kimsuky’ targeting experts with new spearphishing campaign | | Kimsuky, Velvet Chollima |
| 2023-05 | Kimsuky Group Using Meterpreter to Attack Web Servers | | Kimsuky, Velvet Chollima |
| 2023-05 | Kimsuky Group’s Phishing Attacks Targetting North Korea-Related Personnel | | Kimsuky, Velvet Chollima |
| 2023-11 | SmallTiger Malware Used in Attacks Against South Korean Businesses (Kimsuky and Andariel) | | Kimsuky, Velvet Chollima |
| (reporting period 2023-2024) | Kimsuky social engineering against German research, public administration, legal advice and education sectors | Germany | APT43 / Velvet Chollima / Kimsuky / Emerald Sleet |
| 21.02.2024 | North Korean state-sponsored hacker group Kimsuky exploited vulnerabilities to gain access to ScreenConnect customer systems since at least 21 February 2024 | Not available | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2024 | Operation “DEEP#GOSU” | | Kimsuky, Velvet Chollima |
| 2024-01 | North Korean hackers exploit VPN update flaw to install malware | | Kimsuky, Velvet Chollima |
| 2024-03 | Attack Activities by Kimsuky Targeting Japanese Organizations | | Kimsuky, Velvet Chollima |
| 2024-05 | North Korean Hackers Exploit Facebook Messenger in Targeted Malware Campaign | | Kimsuky, Velvet Chollima |
| 2024-07 | APT Group Kimsuky Targets University Researchers | | Kimsuky, Velvet Chollima |
| 2024-09 | North Korea Hackers Linked to Breach of German Missile Manufacturer | | Kimsuky, Velvet Chollima |
| 2024-09 | North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks | | Kimsuky, Velvet Chollima |
| 2024-02-14T12:00:00+00:00 (published_time) | Emerald Sleet spear-phishing of experts on North Korea and use of LLMs | | Emerald Sleet (THALLIUM); overlaps Kimsuky, Velvet Chollima |
| 2025-02 | Operation “DEEP#DRIVE” | | Kimsuky, Velvet Chollima |
| 2025-02 | Phishing Email Attacks by the Larva-24005 Group Targeting Japan | | Kimsuky, Velvet Chollima |