DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Operation “DEEP#DRIVE”

Date (as written)
2025-02
Year
2025
Actors (as written)
Kimsuky, Velvet Chollima
Actor pages
KimsukyVelvet Chollima

Source entries (2)

ThaiCERT Threat Group Cards

Operation “DEEP#DRIVE” · 2025-02
Operation “DEEP#DRIVE” Analyzing DEEP#DRIVE: North Korean Threat Actors Observed Exploiting Trusted Platforms for Targeted Attacks https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/
https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/

Hackmageddon cyber attacks timelines (Paolo Passeri)

South Korean Business, Government, and Cryptocurrency Sectors · 13/02/2025
Researcher at Securonix unveil the details of DEEP#DRIVE, a campaign by the North Korean threat actor Kimsuky targeting South Korean business, government, and cryptocurrency sectors. [Date Occurred: -; Date Discovered: -]
https://www.hackmageddon.com/2025/07/23/1-15-february-2025-cyber-attacks-timeline/
https://thehackernews.com/2025/02/north-korean-apt43-uses-powershell-and.html

Values found later for empty fields

country: South Korean
The DEEP#DRIVE attack campaign represents a sophisticated and multi-stage operation targeting South Korean businesses, government entities and cryptocurrency users.
https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/

Suggest a correction on GitHub