| Jun 2005 | Targeting of American defense industry | American defense industry | Lazarus Group |
| 2011-03 | 3.4 DDoS | Korea, Republic of, 🇺🇸 United States | |
| 2013-03 | 3.20 Cyber Terror | Korea, Republic of | WHOis Team |
| 01.01.2013 | Operation“Kimsuky” | Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;China;China;China;China | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2014-12 | Sony Pictures Entertainment | United States | Lazarus |
| 2014-07 | Seoul Metro | Korea, Republic of | |
| On December 2 and 3, 2014 | Spear-phishing of AMC Theatres employees | U.S. | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| October 2015 | CSIS entry 990 | | |
| 2016-08 | Defense Network | Korea, Republic of | Andariel |
| Aug 2016 | Compromise of computer networks associated with diplomats, journalists, and others in South Korea | South Korea | |
| Feb 2016 | Lazarus Group | South Korea, Sony Pictures Entertainment , United States, Bangladesh Bank, Defense companies in Israel and the Middle East, Global banks, U.S. defense contractors | Dark Seoul; malware analysis report; on a tool called Typeframe used by the Lazarus Group.; In September 2018, the U.S. Department of Justice; criminally charged and sanctioned; Park Jin-hyok and Chosun Expo Joint Venture, alleged members of this threat actor. |
| May 2016 | SWIFT-related bank heists | Bangladesh Central Bank, Tien Phong Bank, Banco Del Austro, Poland | Lazarus Group; In September 2018, the U.S. Department of Justice; announced; criminal charges alleging that North Korean entities were responsible for this incident. |
| 2017-10 | Far Eastern International Bank | Taiwan | Bluenoroff |
| 2017-05 | WannaCry Ransomware | ZZZ, 🇷🇺 Russian Federation, 🇯🇵 Japan, 🇬🇧 United Kingdom, 🇫🇷 France, 🇰🇷 Korea, Republic of, 🇮🇳 India, 🇨🇳 China, 🇩🇪 Germany, 🇪🇸 Spain, 🇮🇩 Indonesia, 🇧🇷 Brazil, 🇺🇸 United States | Lazarus |
| October 2017 | CSIS entry 892 | | |
| May-Sept 2017 / 23 September 2017 | ROK Police reported attacks on three cryptocurrency exchanges by DPRK actors and detailed that 25 employees | ROK | Suspected DPRK (annex title) |
| 2018-12 | GBNKCenter | Korea, Republic of | |
| 2018-04 | Operation “GhostSecret” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2/1/2019 | Babyshark - US | US / N Korea | |
| 2018-02-20 (datePublished) | APT37 (Reaper) operations incl. zero-days and wiper malware | Primarily South Korea – though also Japan, Vietnam and the Middle East | APT37 (Reaper; Scarcruft; Group123) |
| 2018-10-03 (datePublished) | APT38 financial crime against banks worldwide (since at least 2014) | at least 13 countries | APT38 |
| Feb 2018 | Targeting of global financial organizations and bitcoin users | | Lazarus Group; Suspected state sponsor; Korea (Democratic People's Republic of); Type of incident; Espionage; Target category; Private sector; Read more; Lazarus Resurfaces, Targets Global Banks and Bitcoin Users; Footer; Logo; About; Member Programs; Contact; Support; For Media; Newsletters; Membership; Careers; Facebook; YouTube; Instagram; LinkedIn; ©2026 Council on Foreign Relations.; All rights reserved.; Privacy Policy; and; Terms of Use; . |
| May 2018 | Targeting of North Korean defectors and journalists | South Korea | Lazarus Group |
| Sep 2018 | Targeting of U.S. defense contractors | United States | Lazarus Group |
| 2019-10 | Kudankulam Nuclear Power Plant | India | Lazarus |
| Sep 2019 | Autumn Aperture—malware embedded in antiquated file types | Unnamed U.S.-based entities | Kimusky |
| 21/08/2019 | North Korea? | >1 | ? |
| 01.07.2019 | Fractured Statue | United States | TA406/Konni Group/Opal Sleet fka OSMIUM < Kimsuky |
| 2019-11-07 | Indian Space Research Organisation (ISRO) | India | NGB 3rd Technical Surveillance Bureau |
| Nov 2019 | Targeting of South Korean macOS users | South Korean macOS users | Lazarus Group; The North Korean threat actor; Lazarus Group |
| 2020/11/16 | Lazarus supply-chain attack in South Korea | | |
| Since February 2020 | Resumed bank targeting: fraudulent international money transfers and ATM cash outs | | BeagleBoyz |
| 2021-05-31T17:00:00+00:00 | Kimsuky APT continues to target South Korean government using AppleSeed backdoor | South Korea | Kimsuky (Thallium, Black Banshee, Velvet Chollima) |
| 01.01.2020 | ThreatNeedle: Defense Industries | Unknown | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-01-25T23:59:00+00:00 (datePublished) | Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects) | | government-backed entity based in North Korea |
| 2020-11-13T13:59:58+00:00 (published_time) | Cerium targeting Covid-19 vaccine and treatment researchers (WHO-themed spear-phishing) | Canada, France, India, South Korea and the United States (all three actors combined) | Cerium |
| 27/10/2020 | Individuals and organizations in South Korea, Japan, and the United States | >1 | ? |
| October 2020 | CSIS entry 557 | | |
| mid-March 2020 | “Security alert”-themed spear-phishing of 28 individuals including 11 officials from six Security Council members | | Kimsuky advanced persistent threat group |
| August 13, 2020 | Operation ‘Dream Job’ Widespread North Korean Espionage Campaign | | |
| June 2020 | CSIS entry 615 | | |
| 2020-01-08T10:00:47 | Operation AppleJeus Sequel | | |
| Since January 2020 | AppleJeus campaign against energy, finance, government, industry, technology and telecom sectors in 30+ countries | Argentina, Australia, Belgium, Brazil, Canada, China, Denmark, Estonia, Germany, Hong Kong, Hungary, India, Ireland, Israel, Italy, Japan, Luxembourg, Malta, the Netherlands, New Zealand, Poland, Russia, Saudi Arabia, Singapore, Slovenia, South Korea, Spain, Sweden, Turkey, the United Kingdom, Ukraine, and the United States | HIDDEN COBRA; Lazarus Group |
| 2020-05-12 (report date) | COPPERHEDGE / Manuscrypt targeting of cryptocurrency exchanges | | HIDDEN COBRA |
| 2022-07 | Maui Ransomware | United States, 🇯🇵 Japan | Andariel |
| 2021-06 | Seoul National University Hospital | Korea, Republic of | |
| 2021-06 | Korea Atomic Energy Research Institute | Korea, Republic of | |
| January 2022 | CSIS entry 396 | | |
| February 2021 | CSIS entry 509 | | |
| 01.05.2021 | DeathNote cluster | Korea, Republic of;Korea, Republic of;Latvia;Latvia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| Nov 2021 | Targeting of Chinese cybersecurity researchers. | Chinese hacking groups | Lazarus Group |
| 2021-07-12 | 12th July – Threat Intelligence Report | | |
| Apr 2021 | Targeting of South African freight companies | South African shipping companies | Lazarus Group |
| 2021-06-15T12:40:11 | Andariel evolves to target South Korea with ransomware | | |
| 26/11/2021 | Employees at South Korean security companies | KR | Attackers from North Korea (Zinc) |
| 2021-08-17T16:15:15+00:00 (published_time) | InkySquid strategic web compromise of Daily NK delivering BLUELIGHT (late March to early June 2021) | South Korean | InkySquid (ScarCruft, APT37) |
| 2023-03 | 3CX | United States | UNC4736 |
| 2022-06 | Harmony Bridge | United States | |
| 2022-03 | Axie Infinity | Viet Nam | |
| August 2023 | CSIS entry 201 | | |
| April 2022 | CSIS entry 353 | | |
| 2022-02 | On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 22.12.2022 | State-sponsored North Korean hacker group Andariel stole sensitive information from South Korean defense companies as well as research institutes and pharmaceutical companies since at least 22 December 2022 | Korea, Republic of;Not available;Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2022-09 | SlowMist: Investigation of North Korean APT’s Large-Scale Phishing Attack on NFT Users | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 27 Apr 2022 | Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets | | |
| 18/04/2022 | Organizations in the cryptocurrency and blockchain industries | US | Lazarus Group AKA APT38 |
| 2022-01-13T09:00:23 | The BlueNoroff cryptocurrency hunt is still on | | |
| Jul 2022 | Targeting of European Union (EU) member states | Czech Republic, Poland, and other EU countries | APT 37 |
| 数年来 (as of 2022) | Lazarus targeting of Japanese crypto-asset businesses for several years | Japan | ラザルス (北朝鮮当局の下部組織とされる) |
| Apr 2022 | Targeting of journalists reporting on North Korea | Journalists and the former director of South Korea’s National Intelligence Service | APT 37 |
| Jul 2022 | Targeting of South Korea with multiple spear-phishing campaigns | South Korean defense, education, medical, and energy companies and government agencies | Kimsuky |
| Aug 2022 | Targeting of South Korean diplomats, professors, and researchers | Six professors at different universities in South Korea, three think tank researchers, the former South Korean ambassador to the UN, a prominent diplomat in the South Korean government, and a representative on the Research Council for North Korea | Kimsuky |
| Feb 2022 | Targeting of the International Atomic Energy Agency and South Korean defense contractor | The International Atomic Energy Agency and Korea Aerospace Industries, a South Korean defense contractor | Kimsuky |
| 2022-12-01T15:41:19+00:00 (published_time) | Lazarus Group AppleJeus campaign via fake BloxHolder cryptocurrency trading website and malicious Office documents | | Lazarus Group |
| 2023-09 | Mixin Network | Hong Kong | |
| 2023-09 | CoinEx | United States | Lazarus |
| 2023-09 | Stake.com | Australia | Lazarus |
| 2023-07 | CoinsPaid | Estonia | Lazarus |
| 2023-06 | JumpCloud | United States | UNC4899 |
| 2023-06 | Atomic Wallet | Estonia | Lazarus |
| 2023-04-05T12:00:00+00:00 (datePublished) | ARCHIPELAGO (subset of APT43) phishing of North Korea policy experts | South Korea, the US and elsewhere | ARCHIPELAGO (subset of APT43) |
| 02/02/2023 | Organizations in medical research, healthcare, chemical engineering, energy, defense, and a leading research university | >1 | Lazarus Group |
| 2023-12-11T13:50:59.000Z | Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang | | |
| 2023-11 | Kimsuky Targets South Korean Research Institutes with Fake Import Declaration | | Kimsuky, Velvet Chollima |
| 2023-08-24T12:04:22.000Z | Lazarus Group's infrastructure reuse leads to discovery of new malware | | |
| 21/06/2023 | Multiple organizations | N/A | APT37 (AKA StarCruft, Reaper, or RedEyes) |
| 2023-07-18T14:43:24+00:00 | Security alert: social engineering campaign targets technology industry employees | | Jade Sleet; TraderTraitor |
| 2023-10 | Elastic catches DPRK passing out KANDYKORN | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-05-04T13:55:19.000Z | Kimsuky Evolves Reconnaissance Capabilities in New Global Campaign | SentinelOne | | |
| May 2023 | Targeting of cryptocurrency exchanges in DangerousPassword campaign | Cryptocurrency exchanges in Japan and other countries | Lazarus Group |
| 2023-11-10 | 자산 관리 프로그램을 악용한 공격 정황 포착 (Andariel 그룹) | | Andariel; Kimsuky; Lazarus |
| Nov 2023 | Targeting of Danish critical infrastructure companies | Users of CyberLink’s Promeo software | Sandworm |
| Apr 2023 | Targeting of human rights groups and activists related to human rights advocacy in North Korea | Human rights groups and activists focused on North Korea | Believed to be the work of the North Korean government |
| April 21 2023 (dateCreated 2023-04-21) | 'RustBucket' malware targets macOS | | BlueNoroff (sub-group of Lazarus Group) |
| Aug 2023 | Targeting of South Korean defense industry and an electronics manufacturer | South Korean defense conglomerates, universities, and electronics manufacturers | Lazarus Group |
| Apr 2023 | Targeting of South Korean institutions | South Korean education, construction, diplomatic, and political institutions | Tonto Team |
| 2023-01-13 | 김수키(Kimsuky)조직, 카카오 피싱 공격 진행 중 | | Kimsuky; 김수키; 북한 정찰총국; 정찰총국 |
| 14/06/2023 | South Korea | KR | North Korea |
| 2024-05 | FakePenny Ransomware | ZZZ | Moonstone Sleet |
| 2024-06-27 | Kimsuky Deploys TRANSLATEXT Chrome Extension |ThreatLabz | | |
| May 2024 | Moonstone Sleet | Aerospace and defense industry firms | Believed to be associated with the North Korean government |