| June 2017 | CSIS entry 918 | | |
| 2017-04-10 | 2017-4-10 Global Cyber Attack Reports | | |
| 2017-05-22 | 2017-5-22 Global Cyber Attack Reports | | |
| 2018-08 | Ryuk Ransomware | United States, ZZZ | Lazarus |
| 2019-10 | Kudankulam Nuclear Power Plant | India | Lazarus |
| 01.01.2019 | Lazarus turns against Russia | Russia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2019-05-13 | 북한 해커들, 데이터 탈취를 위해 ELECTRICFISH 사용해 | | HIDDEN COBRA; Hidden Cobra; Lazarus; 라자루스 |
| 2019-05-13T10:00:03 | ScarCruft continues to evolve, introduces Bluetooth harvester | | |
| 2019-08-19 | 19th August – Threat Intelligence Bulletin | | |
| 2019-12-09 | 9th December – Threat Intelligence Bulletin | | |
| 2019-12-11T17:00:24.000Z | 5 Things to Know About SentinelLabs’ Finding Link Between Crimeware and APT Lazarus | SentinelOne | | |
| 17/12/2019 | Multiple targets | >1 | The Lazarus Group |
| 2020-07 | VHD Ransomware | ZZZ | Lazarus |
| 01.01.2020 | ThreatNeedle: Defense Industries | Unknown | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-01-25T23:59:00+00:00 (datePublished) | Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects) | | government-backed entity based in North Korea |
| November 2020 | CSIS entry 539 | | |
| 2020-11-13T13:59:58+00:00 (published_time) | Cerium targeting Covid-19 vaccine and treatment researchers (WHO-themed spear-phishing) | Canada, France, India, South Korea and the United States (all three actors combined) | Cerium |
| 23/12/20 | Undisclosed pharmaceutical company | N/A | Lazarus Group |
| August 13, 2020 | Operation ‘Dream Job’ Widespread North Korean Espionage Campaign | | |
| Jul 29, 2020 | Operation (North Star) North Star: A Job Offer That's Too Good to be True? | | Hidden Cobra |
| 2020-01-08T10:00:47 | Operation AppleJeus Sequel | | |
| 2020-05-12 (report date) | COPPERHEDGE / Manuscrypt targeting of cryptocurrency exchanges | | HIDDEN COBRA |
| 2020-11-09 | 9th November - Threat Intelligence Bulletin | | |
| 2020-01-03 | 微软将朝鲜黑客组织告上法庭——以法律之剑，斩APT组织之链 | | |
| 2020/06/17 | Operation In(ter)ception: Aerospace and military companies in the crosshairs of cyberspies | | |
| 07/06/2020 | Multiple online stores | >1 | Lazarus Group AKA Hidden Cobra |
| 22/07/2020 | Corporate entities from multiple countries | >1 | The Lazarus Group AKA HIDDEN COBRA |
| early this year (report dated 2020-08-19) | Job-posting lure campaign against government/defense contractors (BLINDINGCAN) | | HIDDEN COBRA; "A threat group with a nexus to North Korea" |
| 2021-06 | Korea Atomic Energy Research Institute | Korea, Republic of | |
| January 2022 | CSIS entry 396 | | |
| September 2021 | CSIS entry 422 | | |
| 2021-03-31T16:00:00+00:00 (datePublished) | Fake offensive security company "SecuriElite" set up to target security researchers | Turkey (claimed location of fake company) | North Korean government-backed entity |
| 2021-03 | ScarCruft surveilling North Korean defectors and human rights activists | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| November 18, 2021 | TA406 credential theft campaigns (2021) against foreign policy experts, journalists and NGOs | | TA406 (part of Kimsuky / Thallium / Konni) |
| 10/11/2021 | Security Researchers worldwide | >1 | Lazarus Group AKA HIDDEN COBRA |
| 2021-07-12 | 12th July – Threat Intelligence Report | | |
| Apr 2021 | Targeting of South African freight companies | South African shipping companies | Lazarus Group |
| 2021-01-25 | 25th January - Threat Intelligence Report | | |
| 2021-02-08 | 8th February - Threat Intelligence Report | | |
| May 24, 2021 | Attributing CryptoCore Attacks Against Crypto Exchanges to LAZARUS (North Korea) | | |
| 2021-06-22 | NukeSped Copies Fileless Code From Bundlore, Leaves It Unused | | |
| 2021-11-01 | 1st November – Threat Intelligence Report | | |
| 2023-03 | 3CX | United States | UNC4736 |
| 2022-03 | Axie Infinity | Viet Nam | |
| 2022-11-15T10:00:28 | DTrack activity targeting Europe and Latin America | | |
| 01.02.2022 | Between February and July 2022, the North Korean group Lazarus targeted organizations, including energy service providers worldwide | Global (region);Canada;United States;Japan | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2022-01 | North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-07 | Operation “STIFF#BIZON” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022-10 | Internet Explorer 0-day exploited by North Korean actor APT37 | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 18/04/2022 | Organizations in the cryptocurrency and blockchain industries | US | Lazarus Group AKA APT38 |
| 2022-01-13T09:00:23 | The BlueNoroff cryptocurrency hunt is still on | | |
| Apr 2022 | Targeting of journalists reporting on North Korea | Journalists and the former director of South Korea’s National Intelligence Service | APT 37 |
| 2022-02-14 | 14th February– Threat Intelligence Report | | |
| May 6, 2022 | Blender.io used by DPRK to launder stolen virtual currency | | DPRK; "a DPRK state-sponsored hacking group" |
| 2022-07-09T17:00:00+00:00 | North Korean APT targets US healthcare sector with Maui ransomware | United States | State-sponsored North Korean threat actors |
| 2022-07-28T09:39:56+00:00 (published_time) | SharpTongue SHARPEXT mail-stealing browser extension incidents (since September 2021) | | SharpTongue (Kimsuky) |
| 2022-08-08 | 8th August – Threat Intelligence Report | | |
| 2022-08-08 | 8th August – Threat Intelligence Report | | |
| 2022-08-25T01:00:31 | Kimsuky’s GoldDragon cluster and its C2 operations | | |
| 2022-10-03 | 3rd October – Threat Intelligence Report | | |
| 2023-09 | Stake.com | Australia | Lazarus |
| 2023-07 | CoinsPaid | Estonia | Lazarus |
| 2023-06 | Atomic Wallet | Estonia | Lazarus |
| August 2023 | CSIS entry 190 | | |
| February 09, 2023 | DPRK ransomware attacks on Healthcare and Public Health and other critical infrastructure | | DPRK cyber actors |
| 2023-07-18T14:43:24+00:00 | Security alert: social engineering campaign targets technology industry employees | | Jade Sleet; TraderTraitor |
| 2023-07 | Operation “STARK#MULE” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| April 21 2023 (dateCreated 2023-04-21) | 'RustBucket' malware targets macOS | | BlueNoroff (sub-group of Lazarus Group) |
| 2023-10-18 (press release date) | Justice Department Announces Court-Authorized Action to Disrupt Illicit Revenue Generation Efforts of Democratic People’s Republic of Korea Information Technology Workers | | |
| 2023-01-02 | 2nd January – Threat Intelligence Report | | |
| 2023-03-21 | APT37 | ThreatLabz | | |
| 2023-03-30T11:37:54+00:00 (published_time) | 3CX Desktop App supply chain compromise (ICONIC) | | UTA0040, later attributed to Lazarus |
| 2023-05-01 | Chain Reaction: ROKRAT’s Missing Link | | |
| 10/05/2023 | Seoul National University Hospital (SNUH) | KR | North Korean threat actor (Kimsuky) |
| 2023-05-23T11:23:42.000Z | Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit | SentinelOne | | |
| June 1, 2023 | Impersonation of South Korean think tank researchers | South Korea | Kimsuky (Thallium, APT43, Velvet Chollima, Black Banshee) |
| 2023-07-03 | 3rd July – Threat Intelligence Report | | |
| 07/08/2023 | NPO Mashinostroyeniya | RU | ScarCruft |
| 29/09/2023 | Undisclosed Spanish aerospace company | ES | Lazarus Group (AKA HIDDEN COBRA) |
| 2024-07 | WazirX | India | Lazarus |
| 2024-05 | The Crypto Game of Lazarus APT: Investors vs. Zero-days | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 21/08/2024 | Undisclosed organization(s) | Unknown | UAT-5394 linked to Kimsuky |
| 2024-01-01 | 1st January – Threat Intelligence Report | | |
| 03/01/2024 | Multiple organizations within the cryptocurrency and the blockchain industries | >1 | TA444 (a.k.a. Sapphire Sleet, BLUENOROFF, STARDUST CHOLLIMA) |
| 2024-04-29 | 29th April – Threat Intelligence Report | | |
| 23/07/2024 | KnowBe4 | US | Threat actors from North Korea |
| 2024-09-26T03:00:51 | Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy | | |
| 2024-10-21 | 21st October – Threat Intelligence Report | | |
| 2024-12-19T10:00:55 | Lazarus group evolves its infection chain with old and new malware | | |
| 25/12/2024 | Multiple Organizations | >1 | ? |
| 2025-02 | Bybit | United Arab Emirates | Lazarus |
| 2025/10/23 | Gotta fly: Lazarus targets the UAV sector | | |
| In recent months (as of 2025-01-23) | IT workers extorting employers with stolen data and code | United States | North Korean IT workers |
| 2025-06-23 | 23rd June – Threat Intelligence Report | | |
| 2025-08-25 | 25th August – Threat Intelligence Report | | |
| From around December 2025 through July 2026 | WaterPlum / Contagious Interview fake job-interview malware campaign (30,000 PCs, 100+ countries) | | WaterPlum ("Contagious Interview") |
| 2026-09 | Bitget | Seychelles | Trader Traitor |
| 24 Feb 2026 | North Korean Lazarus Group Now Working With Medusa Ransomware | | |
| 2026-01-22 | KONNI Adopts AI to Generate PowerShell Backdoors | | |
| 2026-01-26 | 26th January – Threat Intelligence Report | | |
| 2026-02-23 | 2025: The Untold Stories of Check Point Research | | |
| 2026-07-01T17:53:56.469Z | PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems | | |
| 2026-08-11 | Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack | | |
| 2026-08-17 | 17th August – Threat Intelligence Report | | |
| 2026-09-07 | 7th September – Threat Intelligence Report | | |