| 2014-12 | Sony Pictures Entertainment | United States | Lazarus |
| 2014-12 | Korea Hydro and Nuclear Power | Korea, Republic of | Kimsuky |
| 2014-07 | Seoul Metro | Korea, Republic of | |
| On December 2 and 3, 2014 | Spear-phishing of AMC Theatres employees | U.S. | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| On December 9, 2015 | Fraudulent wire transfers from the Vietnamese Bank | Vietnam | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| 2015-01 | Banco del Austro | Ecuador | Bluenoroff |
| October 2015 | CSIS entry 990 | | |
| 2018-10 | FASTCash | ZZZ | Hidden Cobra |
| 2016-08 | Defense Network | Korea, Republic of | Andariel |
| 2016-05 | SK/Hanjin | Korea, Republic of | Andariel |
| 2016-02 | Bangladesh Central Bank | Bangladesh | Bluenoroff |
| March 2016 | CSIS entry 977 | | |
| Aug 2016 | Compromise of computer networks associated with diplomats, journalists, and others in South Korea | South Korea | |
| 2017-10 | Central American Online Casino | | Bluenoroff |
| 2017-10 | Far Eastern International Bank | Taiwan | Bluenoroff |
| 2017-05 | WannaCry Ransomware | ZZZ, 🇷🇺 Russian Federation, 🇯🇵 Japan, 🇬🇧 United Kingdom, 🇫🇷 France, 🇰🇷 Korea, Republic of, 🇮🇳 India, 🇨🇳 China, 🇩🇪 Germany, 🇪🇸 Spain, 🇮🇩 Indonesia, 🇧🇷 Brazil, 🇺🇸 United States | Lazarus |
| 2017-04 | Yapizon | Korea, Republic of | Bluenoroff |
| 2017-12-15 | Bitcoin Insiders in London | United Kingdom of Great Britain and Northern Ireland | NGB 3rd Technical Surveillance Bureau |
| 2018-12 | RedBanc | Chile | Hidden Cobra |
| 2018-05 | Sejong Institue | Korea, Republic of | Andariel |
| 2018-01 | Bancomext | Mexico | Bluenoroff |
| 2018-08 | Operation “AppleJeus” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2019-10 | Kudankulam Nuclear Power Plant | India | Lazarus |
| 21/08/2019 | North Korea? | >1 | ? |
| 01.07.2019 | Fractured Statue | United States | TA406/Konni Group/Opal Sleet fka OSMIUM < Kimsuky |
| 2019-11-07 | Indian Space Research Organisation (ISRO) | India | NGB 3rd Technical Surveillance Bureau |
| 2021-05-31T17:00:00+00:00 | Kimsuky APT continues to target South Korean government using AppleSeed backdoor | South Korea | Kimsuky (Thallium, Black Banshee, Velvet Chollima) |
| 2021-01-25T23:59:00+00:00 (datePublished) | Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects) | | government-backed entity based in North Korea |
| 23/12/20 | Undisclosed pharmaceutical company | N/A | Lazarus Group |
| mid-March 2020 | “Security alert”-themed spear-phishing of 28 individuals including 11 officials from six Security Council members | | Kimsuky advanced persistent threat group |
| August 13, 2020 | Operation ‘Dream Job’ Widespread North Korean Espionage Campaign | | |
| 2020-10-01 | Alejandro Caceres | United States of America | James Willy |
| 2020-09-03 | CNN-News18 | India | NGB 3rd Technical Surveillance Bureau |
| published 2020-08-28 | DOJ forfeiture complaint for 280 addresses tied to two exchange hacks | | Lazarus Group |
| 2020-08-25 | Cryptocurrency exchange | Undetermined | NGB 3rd Technical Surveillance Bureau |
| 2021-11 | bZx | United States | Bluenoroff |
| 2021-06 | Korea Atomic Energy Research Institute | Korea, Republic of | |
| February 2021 | CSIS entry 509 | | |
| April 2022 | CSIS entry 353 | | |
| 2022-11-15T10:00:28 | DTrack activity targeting Europe and Latin America | | |
| 2022 Early | Tracing State-Aligned Activity Targeting Journalists, Media | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-08 | deBridge Finance crypto platform targeted by Lazarus hackers | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-12-27T08:00:26 | BlueNoroff introduces new methods bypassing MoTW | | |
| 2022-07-05 | Multiple organizations in Japan | Japan | NGB 3rd Technical Surveillance Bureau |
| 27 Apr 2022 | Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets | | |