| Hackmageddon cyber attacks timelines (Paolo Passeri) | 395 |
| tayvano/lazarus-bluenoroff-research | 309 |
| lazarus.day | 227 |
| Kaspersky Securelist | 218 |
| ESTsecurity 알약 블로그 (blog.alyac.co.kr) | 200 |
| AhnLab ASEC blog (asec.ahnlab.com) | 179 |
| ThaiCERT Threat Group Cards | 165 |
| UN Panel of Experts S/2024/215 | 165 |
| Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.) | 154 |
| EuRepoC | 147 |
| Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025 | 124 |
| Check Point Research | 105 |
| CFR Cyber Operations Tracker | 101 |
| CSIS Significant Cyber Incidents | 80 |
| Boannews 보안뉴스 (boannews.com) | 68 |
| US court filing via CourtListener RECAP: United States v. Hyok | 56 |
| UN Panel of Experts S/2023/171 | 46 |
| CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA) | 45 |
| UN Panel of Experts S/2019/691 | 39 |
| Dyadic Cyber Incident Dataset v2 | 37 |
| Genians Security Center blog (genians.co.kr) | 37 |
| ReversingLabs blog | 36 |
| ESET WeLiveSecurity | 35 |
| UN Panel of Experts S/2023/656 | 30 |
| US Department of Justice press releases | 29 |
| Microsoft Digital Defense Report | 26 |
| Microsoft Threat Intelligence (Microsoft Security Blog) | 25 |
| Socket.dev blog | 24 |
| CYFIRMA research | 22 |
| Veracode blog (incl. migrated Phylum research posts) | 22 |
| Dailysecu 데일리시큐 (dailysecu.com) | 21 |
| Palo Alto Networks Unit 42 | 20 |
| UN Panel of Experts S/2022/668 | 20 |
| Google Threat Intelligence Group (GTIG) / Google Cloud | 19 |
| Mandiant / Google Cloud Threat Intelligence blog | 19 |
| QiAnXin Threat Intelligence Center (RedDrip) | 18 |
| Recorded Future Insikt Group | 18 |
| CrowdStrike blog | 17 |
| SentinelOne SentinelLabs | 16 |
| Wikipedia (English), accessed 2026-10-06 | 16 |
| ZDNet Korea (zdnet.co.kr) | 16 |
| S2W TALON blog (medium.com/s2wblog) | 14 |
| SlowMist Hacked (hacked.slowmist.io) | 14 |
| ZachXBT Telegram channel t.me/investigations (public web view) | 14 |
| Electronic Times (etnews) 전자신문 (etnews.com) | 13 |
| Malwarebytes Labs / ThreatDown blog | 13 |
| Radio Free Asia Korean 자유아시아방송 (rfa.org) | 13 |
| Seoul Shinmun 서울신문 (seoul.co.kr) | 13 |
| 외교부 보도자료 (mofa.go.kr) | 13 |
| Hunt.io blog | 12 |
| Microsoft Security Insider (intelligence report) | 12 |
| Symantec / Broadcom Threat Hunter Team (security.com) | 12 |
| UN Panel of Experts S/2019/171 | 12 |
| 보안뉴스 (boannews) | 12 |
| Proofpoint Threat Insight | 11 |
| Trend Micro Research | 11 |
| VOA Korean (voakorea.com) | 11 |
| SentinelOne blog | 10 |
| Seoul Shinmun (Yonhap) chronology: 북한발 역대 주요 사이버테러 일지 (2016-06-13) | 10 |
| UN Panel of Experts S/2020/151 | 10 |
| UN Panel of Experts S/2022/132 | 10 |
| CSIS, "North Korea's Cyber Operations: Strategy and Responses" (Dec 2015), Appendix | 9 |
| Fortinet FortiGuard Labs blog | 9 |
| Huntress blog | 9 |
| Jamf Threat Labs | 9 |
| KISA cyber threat trend report, 2022 H2 (2022년 하반기 사이버 위협 동향 보고서) | 9 |
| Security NEXT (security-next.com) | 9 |
| SlowMist 2024 Blockchain Security and Anti-Money Laundering Annual Report, section 3.3 DPRK (table 'attributed to DPRK-affiliated groups, with data from SlowMist Hacked') | 9 |
| UN Panel of Experts S/2021/211 | 9 |
| 경찰청 보도자료 (Korean National Police Agency press release, board 1002) | 9 |
| CISA/FBI/Treasury advisory AA21-048A (AppleJeus: Analysis of North Korea's Cryptocurrency Malware) | 8 |
| Cisco Talos blog | 8 |
| DOJ OPA press release: Nationwide actions to combat illicit North Korean government revenue generation (2025-11-14) | 8 |
| Google Threat Analysis Group (TAG) blog | 8 |
| Rekt News leaderboard (rekt.news/leaderboard) | 8 |
| US court filing via CourtListener RECAP: United States v. Hwa | 8 |
| US DOJ press release 2021-02-17 (Jon Chang Hyok, Kim Il, Park Jin Hyok indictment) | 8 |
| CertiK blog: Lazarus Group's Web3 Rampage | 7 |
| CISA/Treasury/FBI/USCYBERCOM advisory AA20-239A (FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks) | 7 |
| Etoday 이투데이 (etoday.co.kr) | 7 |
| Hankook Ilbo 한국일보 (hankookilbo.com) | 7 |
| Moonlock (MacPaw) | 7 |
| Sonatype | 7 |
| Validin blog | 7 |
| Zscaler ThreatLabz | 7 |
| 전자신문 (etnews) [이슈분석] 7·7 디도스, 6·25 사이버테러, 한수원 해킹심리전...홀수 해 반복되는 사이버도발 (2017-02-21) | 7 |
| Edaily 이데일리 (edaily.co.kr) | 6 |
| Elastic Security Labs | 6 |
| Group-IB blog | 6 |
| Intezer blog | 6 |
| MBC News (imnews.imbc.com) | 6 |
| NCC Group | 6 |
| US court filing via CourtListener RECAP: United States v. 113 VIRTUAL CURRENCY ACCOUNTS | 6 |
| US court filing via CourtListener RECAP: United States v. APPROXIMATELY 1,159,834.52 USDT | 6 |
| CISA/State/Treasury/FBI advisory AA20-106A "Guidance on the North Korean Cyber Threat" (list: Cyber Operations Publicly Attributed to DPRK by U.S. Government) | 5 |
| Council of the EU Implementing Regulation (EU) 2020/1125 of 30 July 2020, Annex entry "Chosun Expo" (EUR-Lex; fetched via Wayback copy) | 5 |
| Council of the EU, Implementing Regulation (EU) 2020/1125 (Chosun Expo listing), 30 July 2020 | 5 |
| Daily NK (dailynk.com) | 5 |
| FBI FLASH AC-000001-MW "North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities" (08 January 2026) | 5 |
| Gen Digital (Avast) blog | 5 |
| Hackmageddon | 5 |
| JPCERT/CC Eyes blog: Beware of Contacts through LinkedIn | 5 |
| Nate News (repost) (m.news.nate.com) | 5 |
| Netherlands NCTV Cybersecuritybeeld Nederland 2025 (CSBN 2025; with AIVD/MIVD input) | 5 |
| Qihoo 360 (360.net research/analysis) | 5 |
| Seoul Economic Daily (English edition), "A Decade After OPLAN 5015 Breach, North Korea Turns to AI Hacking" (2026-10-05) | 5 |
| Seoul Shinmun (Yonhap) chronology: 북한의 국내 사이버 테러 일지 (2013-04-10) | 5 |
| Silent Push blog | 5 |
| Team Cymru blog | 5 |
| UN Panel of Experts S/2020/840 | 5 |
| US court filing via CourtListener RECAP: United States v. 1,168,679 In Funds Associated with Two Stablecoin Addresses on The Ethereum Network | 5 |
| US court filing via CourtListener RECAP: United States v. 17 Electronic Accounts located at Google LLC | 5 |
| US-Japan-ROK Joint Statement on Cryptocurrency Thefts by the DPRK, 2025-01-14 (US State Dept) | 5 |
| Volexity blog | 5 |
| Aikido Security blog | 4 |
| CISA/FBI joint advisories on DPRK | 4 |
| Datadog Security Labs | 4 |
| Elliptic blog: How the Lazarus Group is stepping up crypto hacks and changing its tactics | 4 |
| Financial Services Commission (fsc.go.kr) | 4 |
| Japan government 北朝鮮IT労働者に関する企業等に対する注意喚起 (updated 2025-08-27; published on NPA site) | 4 |
| Japan NPA/NCO, US FBI/DC3, Australia ASD's ACSC, Germany BND/BfV joint public attribution: "North Korean WaterPlum (Contagious Interview) Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe" (September 18, 2026) | 4 |
| KISA 2024 National Information Protection White Paper (2024 국가정보보호백서, covers 2023) | 4 |
| KISA cyber threat trend report, 2022 H1 (2022년 상반기 사이버 위협 동향 보고서) | 4 |
| KISA cyber threat trend report, 2023 H2 (2023년 하반기 사이버 위협 동향 보고서) | 4 |
| Microsoft On the Issues blog | 4 |
| New America, "North Korea as a Geopolitical and Cyber Actor" (Leekyung Ko, 2018-06-06) | 4 |
| NSFOCUS (nsfocusglobal.com) | 4 |
| RFA 자유아시아방송 (Korean) | 4 |
| Sekoia.io blog | 4 |
| Supreme Prosecutors Office / district prosecutors press releases (spo.go.kr) | 4 |
| UN Panel of Experts S/2021/777 | 4 |
| US court filing via CourtListener RECAP: United States v. APPROXIMATELY 13.98 MILLION USDT | 4 |
| US court filing via CourtListener RECAP: United States v. BITCOIN AND BTC.B SEIZED FROM EIGHT TRANSACTION HASHES AT CRYPTOCURRENCY BRIDGE-1 | 4 |
| US Treasury OFAC press releases (DPRK cyber designations) | 4 |
| US Treasury press release jy1498 (May 23, 2023) | 4 |
| 한국일보 2009년 '7·7 디도스' 등 대부분 북한소행 결론 (2013-03-20) | 4 |
| Anquanke 安全客 (anquanke.com) | 3 |
| BAE Systems Applied Intelligence (Threat Research Blog) | 3 |
| Checkmarx blog | 3 |
| FBI press release 2023-08-22 | 3 |
| FBI press release 2023-09-06 | 3 |
| France ANSSI/CERT-FR Panorama de la cybermenace 2025 (CERTFR-2026-CTI-002) | 3 |
| KISA 2026 National Information Protection White Paper (2026 국가정보보호백서, covers 2025) | 3 |
| KISA cyber threat trend report, 2023 H1 (2023년 상반기 사이버 위협 동향 보고서) | 3 |
| Kyunghyang Shinmun 경향신문 (khan.co.kr) | 3 |
| Mandiant M-Trends 2024 (PDF) | 3 |
| Mandiant M-Trends 2025 (PDF) | 3 |
| McAfee Labs (ATR) | 3 |
| Ministry of National Defense (mnd.go.kr) | 3 |
| Money Today 머니투데이 (mt.co.kr) | 3 |
| MSMT/2026/1 "The DPRK Use of Overseas Labour to Violate and Evade UN Sanctions" (16 Sep 2026) | 3 |
| Nikkei 日本経済新聞 (nikkei.com) | 3 |
| NK News (nknews.org) | 3 |
| Snyk | 3 |
| Tencent News 腾讯新闻 (news.qq.com) | 3 |
| US court filing via CourtListener RECAP: Kim v. Circle Internet Group, Inc. | 3 |
| US court filing via CourtListener RECAP: United States v. Jin | 3 |
| US court filing via CourtListener RECAP: United States v. VIRTUAL CURRENCY ASSOCIATED WITH NORTH KOREAN IT WORKER MONEY LAUNDERING AND SANCTIONS EVASION CONSPIRACIES | 3 |
| US court filing via CourtListener RECAP: United States v. Wang | 3 |
| US State/Treasury/FBI advisory "Guidance on the Democratic People's Republic of Korea Information Technology Workers" (May 16, 2022) | 3 |
| US Treasury press release jy1435 (April 24, 2023) | 3 |
| US Treasury press release sb0416 (March 12, 2026) | 3 |
| US-Japan-ROK Joint Statement on DPRK Cryptocurrency Thefts and Public-Private Collaboration (2025-01-14; Japanese provisional translation published by NPA) | 3 |
| 과학기술정보통신부 보도자료 (msit.go.kr) | 3 |
| Ajunews 아주경제 (ajunews.com) | 2 |
| Arctic Wolf blog | 2 |
| Australia Foreign Minister media release: Sanctions on cyber criminals funding North Korean weapons of mass destruction (06 November 2025; fetched via Wayback) | 2 |
| Bloomberg Technoz (bloombergtechnoz.com) | 2 |
| Chainalysis blog: $2.2 Billion Stolen from Crypto Platforms in 2024 | 2 |
| Chainalysis blog: Lazarus Group Pulled Off 2020's Biggest Exchange Hack | 2 |
| Chainalysis blog: Stolen Crypto Falls in 2023, but Hacking Remains a Threat | 2 |
| CISA/DHS/FBI alert TA18-149A (HIDDEN COBRA – Joanap and Brambul) | 2 |
| CISA/DHS/Treasury/FBI alert TA18-275A (HIDDEN COBRA – FASTCash Campaign) | 2 |
| CISA/FBI/USCYBERCOM advisory AA20-301A (North Korean APT Focus: Kimsuky) | 2 |
| ClearSky Cyber Security | 2 |
| CrowdStrike Adversary Universe profile | 2 |
| CrowdStrike press release | 2 |
| Daum (repost) (v.daum.net) | 2 |
| Digital Daily 디지털데일리 (m.ddaily.co.kr) | 2 |
| DOJ OPA press release: North Korean Foreign Trade Bank representative (Sim Hyon Sop) charged (2023-04-24) | 2 |
| DOJ OPA press release: Operators of cryptocurrency mixers (Blender.io, Sinbad.io) charged (2025-01-10) | 2 |
| DOJ speech: AAG John C. Demers remarks on North Korean operatives (2021-02-17) | 2 |
| DomainTools Investigations | 2 |
| Elliptic blog: Elliptic 10 year anniversary: the biggest crypto hacks of the last decade | 2 |
| Elliptic blog: The top crypto hacks of 2022 | 2 |
| EU EEAS: DPRK: Statement by the Spokesperson on cyber activities (31.07.2026) | 2 |
| FBI press release "FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's Horizon Bridge Currency Theft" (2023-01-23; via Wayback) | 2 |
| FBI press release "FBI Identifies Cryptocurrency Funds Stolen by DPRK" (2023-08-22; via Wayback) | 2 |
| FBI press release "FBI Identifies Lazarus Group Cyber Actors as Responsible for Theft of $41 Million from Stake.com" (2023-09-06; via Wayback) | 2 |
| FBI press release "Update on Sony Investigation" (2014-12-19; via Wayback) | 2 |
| FBI PSA I-090324-PSA "North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks" (2024-09-03) | 2 |
| FBI/State/NSA + ROK NIS/NPA/MOFA Joint CSA CSA-20230601-1 "North Korea Using Social Engineering to Enable Hacking of Think Tanks, Academia, and Media" (June 1, 2023; copy fetched from content.govdelivery.com) | 2 |
| Fox-IT / NCC Group blog | 2 |
| France ANSSI/CERT-FR CERTFR-2024-CTI-008 Organismes de recherche et think tanks | 2 |
| Germany BfV + ROK NIS second Joint Cyber Security Advisory "Warning of North Korean cyber threats targeting the Defense Sector" (19 February 2024) | 2 |
| Germany BfV Verfassungsschutzbericht 2024 | 2 |
| Germany BfV Verfassungsschutzbericht 2025 | 2 |
| Germany BSI Die Lage der IT-Sicherheit in Deutschland 2023 | 2 |
| Germany BSI Die Lage der IT-Sicherheit in Deutschland 2024 | 2 |
| Gulf News (gulfnews.com) | 2 |
| Hankyung 한국경제 (hankyung.com) | 2 |
| Immunefi Crypto Losses 2024 Report | 2 |
| ITmedia (itmedia.co.jp) | 2 |
| Japan NPA 令和６年におけるサイバー空間をめぐる脅威の情勢等について (2025-03) | 2 |
| JPCERT/CC Eyes blog: New Malicious PyPI Packages used by Lazarus | 2 |
| JPCERT/CC Eyes blog: Practical Challenges of Attribution in the Case of Lazarus's Subgroup | 2 |
| KISA cyber threat trend report, 2024 H2 (2024년 하반기 사이버 위협 동향 보고서) | 2 |
| KISA cyber threat trend report, 2025 H2 (25년 사이버 위협 하반기 동향 및 26년 전망) | 2 |
| Ministry of Unification (unikorea.go.kr) | 2 |
| NEWSECONOMY (neweconomy.jp) | 2 |
| Nocut News 노컷뉴스 (nocutnews.co.kr) | 2 |
| piyolog (piyolog.hatenadiary.jp) | 2 |
| ScanNetSecurity (scan.netsecurity.ne.jp) | 2 |
| Secrss 安全内参 (secrss.com) | 2 |
| Seoul Shinmun news | 2 |
| SlowMist 2023 Blockchain Security and AML Annual Report (SlowMist KYT blog), Lazarus Group section | 2 |
| UK NCSC news "UK supports US charges against North Korean cyber actors" (17 February 2021) | 2 |
| UK NCSC news: NCSC and partners issue warning over North Korean state-sponsored cyber campaign to steal military and nuclear secrets | 2 |
| US court filing via CourtListener RECAP: KIM v. RAILGUN DAO | 2 |
| US court filing via CourtListener RECAP: Kim v. The Democratic People's Republic of Korea | 2 |
| US court filing via CourtListener RECAP: United States v. 280 VIRTUAL CURRENCY ACCOUNTS | 2 |
| US court filing via CourtListener RECAP: United States v. Account XXXX5190 | 2 |
| US court filing via CourtListener RECAP: United States v. APPROXIMATELY 1,008,902.606307 USDT | 2 |
| US court filing via CourtListener RECAP: United States v. APPROXIMATELY 1,694,395.463328 OF TETHER CRYPTOCURRENCY | 2 |
| US court filing via CourtListener RECAP: United States v. User ID account 4690943 | 2 |
| US DOJ press release 2020-08-27 (forfeiture of 280 accounts) | 2 |
| US DOJ press release 2025-06-30 (IT worker actions; N.D. Georgia indictment) | 2 |
| US State Dept Rewards for Justice: Rim Jong Hyok (Andariel) | 2 |
| US State Dept Rewards for Justice: Yanbian Silverstar and Volasys Silverstar | 2 |
| US Treasury press release jy0916 (August 8, 2022) | 2 |
| US Treasury press release jy2790 (January 16, 2025) | 2 |
| US Treasury press release sb0302 (November 4, 2025) | 2 |
| USAO District of Massachusetts press release: Two U.S. nationals (Kejia Wang, Zhenxing Wang) sentenced (2026-04-15) | 2 |
| VOA 한국어 | 2 |
| White House press briefing on the attribution of the WannaCry malware attack to North Korea (December 19, 2017; via Wayback) | 2 |
| Yahoo Finance: ZachXBT Links North Korean IT Workers to Over 25 Crypto Hacks and Team Extortion Schemes | 2 |
| 360 (360.net) (360.net) | 1 |
| Arkham Intelligence: Bitget Hacker: $350M Stolen and Laundered On-Chain | 1 |
| Arkham Intelligence: KelpDAO Hacker Moving Funds | 1 |
| Arkham Intelligence: Lazarus Group: The North Korean Hacking Syndicate's On-Chain Footprint | 1 |
| ASCII.jp (ascii.jp) | 1 |
| Australia Minister for Foreign Affairs media release "Attributing the 'WannaCry' ransomware to North Korea" (20 December 2017; DFAT PDF via Wayback) | 1 |
| Avast Threat Labs (Decoded) | 1 |
| Bitdefender Labs | 1 |
| Business Standard (India) (business-standard.com) | 1 |
| Business Today (India) (businesstoday.in) | 1 |
| Canada CCCS National Cyber Threat Assessment 2018 | 1 |
| Canada CCCS National Cyber Threat Assessment 2020 | 1 |
| Canada CCCS National Cyber Threat Assessment 2023-2024 | 1 |
| Canada CCCS National Cyber Threat Assessment 2025-2026 | 1 |
| CEBnet 电子银行网 (cebnet.com.cn) | 1 |
| Cedar News (cedarnews.net) | 1 |
| CertiK Skynet DPRK Crypto Threats Report | 1 |
| Chainalysis blog: 2019 Cryptocurrency Exchange Hacks | 1 |
| Chainalysis blog: 2025 Crypto Theft Reaches $3.4 Billion | 1 |
| Chainalysis blog: Collaboration in the Wake of Record-Breaking Bybit Theft | 1 |
| Chainalysis blog: Crypto Community Makes Profiting Hard for North Korean Hackers | 1 |
| Chainalysis blog: Drift Protocol Hack: How Privileged Access Led to a $285M Loss | 1 |
| Chainalysis blog: How Chainalysis Used AI to Trace the $387M Bitget Theft | 1 |
| Chainalysis blog: How North Korea-linked cybercriminals hacked Qubit | 1 |
| Chainalysis blog: Inside the KelpDAO Bridge Exploit | 1 |
| Chainalysis blog: Justice Department Demands Forfeiture of 280 Cryptocurrency Addresses | 1 |
| Cheonji Ilbo 천지일보 (newscj.com) | 1 |
| CISA/DHS/FBI alert TA17-318A (HIDDEN COBRA – FALLCHILL) | 1 |
| CISA/DHS/FBI alert TA17-318B (HIDDEN COBRA – Volgmer) | 1 |
| CISA/DHS/FBI MAR-10295134-1.v1 (AR20-232A) BLINDINGCAN | 1 |
| CISA/DHS/FBI/DoD MAR-10288834-1.v1 (AR20-133A) COPPERHEDGE | 1 |
| CISA/FBI/Treasury advisory AA22-108A (TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies) | 1 |
| CISO Club (cisoclub.ru) | 1 |
| CNews Safe (safe.cnews.ru) | 1 |
| Coinotaku (coinotaku.com) | 1 |
| Crypto Watch (Impress) (crypto.watch.impress.co.jp) | 1 |
| Cybersecurity News: Researcher Infiltrates Lazarus Group's Crypto Laundering Network After $1.5B Bybit Hack | 1 |
| Dailian 데일리안 (dailian.co.kr) | 1 |
| Dan Tri (dantri.com.vn) | 1 |
| datanet.co.kr (datanet.co.kr) | 1 |
| DBAPPSecurity 安恒 (starmap.dbappsecurity.com.cn) | 1 |
| Deccan Herald (India) (deccanherald.com) | 1 |
| Detik (detik.com) | 1 |
| Developpez.com (developpez.com) | 1 |
| DOJ OPA press release: Arrest, premises search and website domain seizures vs DPRK IT workers (2024-05-16) | 1 |
| DOJ OPA press release: Civil forfeiture complaint against over $7.74M laundered for North Korea (2025-06-05) | 1 |
| DOJ OPA press release: Coordinated nationwide actions against North Korean remote IT workers (2025-06-30) | 1 |
| DOJ OPA press release: International money launderer (Ghaleb Alaumary) sentenced (2021-09-08) | 1 |
| DOJ OPA press release: Maryland man (Minh Phuong Ngoc Vong) pleads guilty (2025-04-15) | 1 |
| DOJ OPA press release: Maryland man (Vong) sentenced (2025-12-04) | 1 |
| DOJ OPA press release: Tornado Cash founders charged (2023-08-23) | 1 |
| DOJ speech: DAAG Adam Hickey (NSD) remarks at CyberNext (2018-10-04) | 1 |
| EBN (ebn.co.kr) | 1 |
| Economist 이코노미스트 (economist.co.kr) | 1 |
| Elliptic blog: $235 million lost by WazirX in North Korea-linked breach | 1 |
| Elliptic blog: Bitget attack pushes suspected North Korea crypto heists over $1 billion in 2026 | 1 |
| Elliptic blog: Bybit exploit 12 months on: the DPRK threat continues | 1 |
| Elliptic blog: Bybit hack largest in history | 1 |
| Elliptic blog: Drift Protocol exploited for $286 million in suspected DPRK-linked attack | 1 |
| Elliptic blog: Elliptic software follows the money from the Bithumb hack | 1 |
| Elliptic blog: FBI confirms North Korea's Lazarus Group as hackers behind $100 million Harmony Horizon Bridge theft | 1 |
| Elliptic blog: North Korea-linked Atomic Wallet heist tops $100 million | 1 |
| Elliptic blog: North Korea's crypto hackers have stolen over $2 billion in 2025 | 1 |
| Elliptic blog: North Korea's Lazarus Group Identified as Exploiters Behind $540 Million Ronin Bridge Theft | 1 |
| Elliptic blog: North Korea's Lazarus Group likely responsible for $35 million Atomic crypto theft | 1 |
| Elliptic blog: Top five DeFi crime trends of 2022 | 1 |
| Elliptic blog: U.S. to Seize Crypto Accounts Linked to North Korean Hacks | 1 |
| Expel blog | 1 |
| FBI / DC3 / National Police Agency of Japan press release 2024-12-23 | 1 |
| FBI IC3 PSA 250226 (2025-02-26) | 1 |
| FBI press release 2022-04-14 | 1 |
| FBI press release 2023-01-23 | 1 |
| FBI PSA (IC3 PSA250723-4) "North Korean IT Worker Threats to U.S. Businesses" (2025-07-23) | 1 |
| FBI PSA I-012325-PSA "North Korean IT Workers Conducting Data Extortion" (2025-01-23) | 1 |
| FBI PSA I-022625-PSA "North Korea Responsible for $1.5 Billion Bybit Hack" (2025-02-26) | 1 |
| FBI PSA I-051624-PSA "DPRK Leverages U.S.-Based Individuals to Defraud U.S. Businesses and Generate Revenue" (2024-05-16) | 1 |
| FBI statement on attribution of malicious cyber activity posed by the DPRK (2022-04-14; via Wayback) | 1 |
| FBI/DC3/Japan NPA press release on TraderTraitor theft from Bitcoin.DMM.com (2024-12-23; via Wayback) | 1 |
| FBI/State/NSA Joint Cybersecurity Advisory JCSA-20240502-001 "North Korean Actors Exploit Weak DMARC Security Policies to Mask Spearphishing Efforts" (2024-05-02) | 1 |
| FBI/State/Treasury + ROK PSA I-101823-PSA "Additional Guidance on the DPRK Information Technology Workers" (2023-10-18) | 1 |
| Financial Services Agency Japan 金融庁 (fsa.go.jp) | 1 |
| fnnews.com (fnnews.com) | 1 |
| Free Press Journal (India) (freepressjournal.in) | 1 |
| G7 Leaders' statement on geopolitical issues, Evian (elysee.fr) | 1 |
| Germany BfV + ROK NIS Joint Cyber Security Advisory "Warning on KIMSUKY Cyber Actor's Recent Cyber Campaigns against Google's Browser and App Store Services" (20 March 2023) | 1 |
| Germany BfV brochure Cyberangriffe – Gefahren, Risiken und Schutz vor staatlich gesteuerten Attacken (Februar 2026) | 1 |
| Germany BfV Private Sector Security Advisory 02/2024 "North Korean IT Workers" (1 October 2024) | 1 |
| Germany BfV Verfassungsschutzbericht 2021 | 1 |
| Germany BfV Verfassungsschutzbericht 2022 | 1 |
| Germany BfV Verfassungsschutzbericht 2023 | 1 |
| Germany BSI Die Lage der IT-Sicherheit in Deutschland 2017 | 1 |
| GitHub Blog (security) | 1 |
| Global Economic 글로벌이코노믹 (g-enews.com) | 1 |
| Gokorea (gokorea.kr) | 1 |
| Habr (habr.com) | 1 |
| Halborn blog: Explained: The BingX Hack (September 2024) | 1 |
| Halborn blog: Explained: The Bitget Hack (September 2026) | 1 |
| Halborn blog: Explained: The Bybit Hack Revisited | 1 |
| Halborn blog: Explained: The Kelp DAO Hack (April 2026) | 1 |
| Halborn blog: Explained: The Orbit Bridge Hack (December 2023) | 1 |
| Halborn blog: Explained: The Poloniex Hack (November 2023) | 1 |
| Halborn blog: Explained: The Tapioca DAO Hack (October 2024) | 1 |
| Halborn blog: Explained: The Upbit Hack (November 2025) | 1 |
| heise online (heise.de) | 1 |
| iCloudNews 爱云资讯 (icloudnews.net) | 1 |
| Immunefi Crypto Losses Q1 2025 Report | 1 |
| Immunefi: A New Era of State-Backed DeFi Blackhats Is Upon Us | 1 |
| Inc42 (India) (inc42.com) | 1 |
| Infobae (infobae.com) | 1 |
| INTERNET Watch (Impress) (internet.watch.impress.co.jp) | 1 |
| Israel Ministry of Defense (DSDE/Malmab) statement, Aug 2020, as quoted by Globes (gov.il primary returned 403) | 1 |
| Japan FSA/NPA/NISC alert on Lazarus targeting crypto businesses (令和4年10月14日 / 2022-10-14) | 1 |
| Japan MOF/MOFA/METI asset-freeze list annex (2022-12-02) | 1 |
| Japan NPA leaflet サイバー空間の脅威の情勢 (令和４年, published 2023-03) | 1 |
| Japan NPA press release 北朝鮮を背景とするサイバー攻撃グループTraderTraitorによる暗号資産関連事業者を標的としたサイバー攻撃について (2024-12-24) | 1 |
| Japan NPA 令和４年におけるサイバー空間をめぐる脅威の情勢等について (2023-03) | 1 |
| Japan NPA 令和７年におけるサイバー空間をめぐる脅威の情勢等について (2026) | 1 |
| Japan NPA/MOFA/MOF/METI 北朝鮮IT労働者に関する企業等に対する注意喚起 (2024-03-26) | 1 |
| Japan NPA/NISC/FSA alert on TraderTraitor (令和6年12月24日 / 2024-12-24) | 1 |
| JFrog Security Research | 1 |
| Jiji Press 時事ドットコム (jiji.com) | 1 |
| JPCERT/CC Eyes blog: Attack Activities by Kimsuky Targeting Japanese Organizations | 1 |
| JPCERT/CC Eyes blog: BLINDINGCAN - Malware Used by Lazarus | 1 |
| JPCERT/CC Eyes blog: Commonly Known Tools Used by Lazarus | 1 |
| JPCERT/CC Eyes blog: Lazarus Attack Activities Targeting Japan (VSingle/ValeforBeta) | 1 |
| JPCERT/CC Eyes blog: Malware Used by Lazarus after Network Intrusion | 1 |
| JPCERT/CC Eyes blog: Operation Dream Job by Lazarus | 1 |
| JPCERT/CC Eyes blog: VSingle malware that obtains C2 server information from GitHub | 1 |
| JPCERT/CC Eyes blog: YamaBot Malware Used by Lazarus | 1 |
| Kandji (Iru) threat library | 1 |
| KeyMan's Net (ITmedia) (kn.itmedia.co.jp) | 1 |
| KISA cyber threat trend report, 2021 H2 (2021년 하반기 사이버 위협 동향 보고서) | 1 |
| KISA cyber threat trend report, 2025 H1 (2025년 상반기 사이버 위협 동향 보고서) | 1 |
| KISA 공지사항 (kisa.or.kr) | 1 |
| Kommersant Коммерсантъ (kommersant.ru) | 1 |
| Kompas TV (kompas.tv) | 1 |
| Korea Times (koreatimes.co.kr) | 1 |
| Korea.kr 정책브리핑 (korea.kr) | 1 |
| Korean National Police Agency (National Office of Investigation), 2024-11-21, as reported by The Korea Herald | 1 |
| Kriptofoni (Turkey) (kriptofoni.com) | 1 |
| L'essentiel (lessentiel.lu) | 1 |
| La Nación (Argentina) (lanacion.com.ar) | 1 |
| La Nación (Costa Rica) (nacion.com) | 1 |
| Law Times 법률신문 (lawtimes.co.kr) | 1 |
| Liputan6 (liputan6.com) | 1 |
| Macnica (security report) | 1 |
| Meduza (meduza.io) | 1 |
| mhns.co.kr (mhns.co.kr) | 1 |
| Multinational "Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers" (July 31, 2026; hosted on ic3.gov; issuing countries described as "Our countries") | 1 |
| Mynavi TECH+ (news.mynavi.jp) | 1 |
| National Police Agency Japan 警察庁 (npa.go.jp) | 1 |
| NetEase News 网易新闻 (c.m.163.com) | 1 |
| Netherlands AIVD Jaarverslag 2025, Cyberdreigingen | 1 |
| NETSCOUT ASERT blog | 1 |
| New Zealand GCSB Annual Report 2018 (fetched via Wayback; gcsb.govt.nz is bot-protected) | 1 |
| New Zealand NCSC Cyber Threat Report 2020/21 | 1 |
| New Zealand NCSC Cyber Threat Report 2026 (2025/26), Judgement 2, Case Study 1: North Korean IT workers in New Zealand | 1 |
| news.bbsi.co.kr (news.bbsi.co.kr) | 1 |
| Newsis 뉴시스 (newsis.com) | 1 |
| Newspim 뉴스핌 (newspim.com) | 1 |
| NGO News 한국NGO신문 (ngonews.kr) | 1 |
| NHK News Web (news.web.nhk) | 1 |
| NSFOCUS blog 绿盟 (blog.nsfocus.net) | 1 |
| NTT Security Japan | 1 |
| NTV (Turkey) (ntv.com.tr) | 1 |
| Okta Security | 1 |
| Outlook India (outlookindia.com) | 1 |
| pennmike.com (pennmike.com) | 1 |
| Periodista Digital (periodistadigital.com) | 1 |
| Pervyi Otdel (dept.one) | 1 |
| Pressian 프레시안 (pressian.com) | 1 |
| Qihoo 360 (360.cn) | 1 |
| RB.ru (rb.ru) | 1 |
| Red Canary | 1 |
| Rocket Boys (rocket-boys.co.jp) | 1 |
| SBS News (news.sbs.co.kr) | 1 |
| SEN TV (sentv.co.kr) | 1 |
| Seoul Shinmun (Yonhap) news | 1 |
| Sina Finance 新浪财经 (finance.sina.com.cn) | 1 |
| Singapore CSA, Singapore Cyber Landscape 2024/2025 | 1 |
| Sisa Journal 시사저널 (sisajournal.com) | 1 |
| SlowMist 2024 Blockchain Security and AML Annual Report, section 2.2.7 BingX | 1 |
| Smart FN 스마트에프엔 (smartfn.co.kr) | 1 |
| spnews.co.kr (spnews.co.kr) | 1 |
| T24 (Turkey) (t24.com.tr) | 1 |
| Tagesspiegel (tagesspiegel.de) | 1 |
| TechRadar France (global.techradar.com) | 1 |
| TechTarget Japan (ITmedia) (techtarget.itmedia.co.jp) | 1 |
| The News Minute (India) (thenewsminute.com) | 1 |
| Thread Reader App unroll of ZachXBT thread (X post 1940388827392344261) | 1 |
| Today Korea 투데이코리아 (todaykorea.co.kr) | 1 |
| Trellix Advanced Research Center | 1 |
| TRM Labs blog: Bitget Loses USD 351.6 Million in Hot Wallet Breach in Likely North Korea Attack | 1 |
| TRM Labs blog: DOJ Seeks Forfeiture of $7.7 Million in Cryptocurrency Tied to North Korean IT Worker Laundering Network | 1 |
| TRM Labs blog: FBI Confirms that North Korea was Behind $41 Million Stake.com Exploit | 1 |
| TRM Labs blog: H1 2026 crypto hacks reach record high as losses fall below USD 1 billion | 1 |
| TRM Labs blog: North Korea and the Industrialization of Cryptocurrency Theft | 1 |
| TRM Labs blog: North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks | 1 |
| TRM Labs blog: North Korean Hackers Attack Drift Protocol In USD 285 Million Heist | 1 |
| TRM Labs blog: North Korean Hackers Stole $600 Million in Crypto in 2023 | 1 |
| TRM Labs blog: The Bybit Hack: Following North Korea's Largest Exploit | 1 |
| TRM Labs blog: TRM Links North Korea to Record $1.5 Billion Record Hack | 1 |
| TRM Labs blog: US authorities tie North Korea's Lazarus Group to Ronin Bridge hack through OFAC sanctions | 1 |
| U.S.-ROK-Japan Joint Statement on DPRK Information Technology Workers (US State Dept media note, August 27, 2025; via Wayback) | 1 |
| UK Cabinet Office speech by Pat McFadden, Cyber is a poster child for growth (7 May 2025) | 1 |
| UK FCDO/Home Office news: UK crackdown on vile scam centres steps up with sanctions on illicit crypto network | 1 |
| UK Foreign & Commonwealth Office press release "Foreign Office Minister condemns North Korean actor for WannaCry attacks" (19 December 2017) | 1 |
| UK HM Treasury OFSI Advisory on North Korean IT Workers | 1 |
| UK NCSC Annual Review 2024 | 1 |
| UK NCSC Annual Review 2025 | 1 |
| UK NCSC news: UK and Republic of Korea issue warning about DPRK state-linked cyber actors attacking software supply chains | 1 |
| US court filing via CourtListener RECAP: Bangladesh Bank v. Rizal Commercial Banking Corporation | 1 |
| US court filing via CourtListener RECAP: BYBIT TECHNOLOGY LIMITED v. DEMOCRATIC PEOPLE'S REPUBLIC OF KOREA | 1 |
| US court filing via CourtListener RECAP: Microsoft Corporation v. John Does 1-2 | 1 |
| US court filing via CourtListener RECAP: United States v. 2,248,478.272519 USDT In Funds Associated With Four Virtual Currency Addresses | 1 |
| US court filing via CourtListener RECAP: United States v. ALL VIRTUAL CURRENCY SEIZED FROM ONE MEXC ACCOUNT ENDING IN 8248, ONE MEXC ACCOUNT ENDING IN 7017, ONE BINANCE ACCOUNT ENDING IN 8327, AND ONE BINANCE ACCOUNT ENDING IN 5604 | 1 |
| US court filing via CourtListener RECAP: United States v. Approximately $397,674.32 | 1 |
| US court filing via CourtListener RECAP: United States v. APPROXIMATELY 1,467,761.163191 USDT | 1 |
| US court filing via CourtListener RECAP: United States v. Approximately 21.17 BTC seized from address 3JB9jkioXqmKS9AbGZFhFyVPPR35Pla43x | 1 |
| US court filing via CourtListener RECAP: United States v. APPROXIMATELY 2210.8222 OF SOL CRYPTOCURRENCY | 1 |
| US court filing via CourtListener RECAP: United States v. APPROXIMATELY 942,462.845 USDT | 1 |
| US court filing via CourtListener RECAP: United States v. CHAPMAN | 1 |
| US court filing via CourtListener RECAP: United States v. DIDENKO | 1 |
| US court filing via CourtListener RECAP: United States v. Emanuel Ashtor | 1 |
| US court filing via CourtListener RECAP: United States v. Knoot | 1 |
| US court filing via CourtListener RECAP: United States v. Phagnasay | 1 |
| US court filing via CourtListener RECAP: United States v. Salazar | 1 |
| US court filing via CourtListener RECAP: United States v. SEALED | 1 |
| US court filing via CourtListener RECAP: United States v. SIM HYON SOP | 1 |
| US court filing via CourtListener RECAP: United States v. Travis | 1 |
| US court filing via CourtListener RECAP: United States v. Twelve (12)".Com" Domain Names | 1 |
| US court filing via CourtListener RECAP: United States v. Vong | 1 |
| US DOJ press release 2020-03-02 (Tian Yinyin, Li Jiadong) | 1 |
| US State Dept Rewards for Justice: North Korea Money Laundering - 9 Individuals | 1 |
| US State Dept Rewards for Justice: North Korean Information Technology (IT) Workers | 1 |
| US Treasury press release jy0768 (May 6, 2022) | 1 |
| US Treasury press release jy1938 (November 30, 2023) | 1 |
| US Treasury press release jy2752 (December 17, 2024) | 1 |
| US Treasury press release sb0190 (July 8, 2025) | 1 |
| US Treasury press release sb0205 (July 24, 2025) | 1 |
| US Treasury press release sb0230 (August 27, 2025) | 1 |
| USAO SDNY press release: Tornado Cash founder Roman Storm convicted (2025-08-06) | 1 |
| VietTimes (viettimes.vn) | 1 |
| 네이트 뉴스 (중앙일보 기사) | 1 |
| 데일리시큐 (dailysecu) | 1 |
| 여성신문 | 1 |
| 한국일보 | 1 |