| 2014-12 | Sony Pictures Entertainment | United States | Lazarus |
| April 06, 2018 | STARDUST CHOLLIMA operations against financial institutions incl. SWIFT abuse; suspected targeting of Latin America-based organizations since mid-2017 | Latin America-based | STARDUST CHOLLIMA |
| June 25, 2018 | DPRK targeted intrusion activity in 2017 and 2018 (Australia commentary; WannaCry, Sony, Bangladesh Bank cited) | Bangladesh | DPRK adversaries |
| November 29, 2021 | SILENT CHOLLIMA intrusion against a pharmaceuticals organization (Export Control dropper) | | SILENT CHOLLIMA |
| 2023-03 | 3CX | United States | UNC4736 |
| February 27, 2025 | FAMOUS CHOLLIMA incidents in 2024 (2025 Global Threat Report) | | FAMOUS CHOLLIMA |
| August 04, 2025 | FAMOUS CHOLLIMA GenAI-enabled infiltration of over 320 companies (2025 Threat Hunting Report) | | FAMOUS CHOLLIMA |
| 2026-03 | Axios | | Bluenoroff |
| January 29, 2026 | GOLDEN CHOLLIMA recruitment-fraud intrusion at a European fintech company and cryptocurrency diversion (late 2024) | European; U.S., Canada, South Korea, India, and Western Europe (general targeting) | GOLDEN CHOLLIMA |
| January 29, 2026 | GOLDEN CHOLLIMA SnakeBaker / NodalBaker deployments at fintech firms (June 2025) | | GOLDEN CHOLLIMA |
| January 29, 2026 | PRESSURE CHOLLIMA high-profile cryptocurrency heists (two largest on record) | | PRESSURE CHOLLIMA (TraderTraitor) |
| January 29, 2026 | LABYRINTH CHOLLIMA targeting of European aerospace and defense manufacturers (2024-2025), logistics and shipping, U.S. manufacturing incl. hydroelectric power | European; U.S., Japanese, and Italian; U.S.-based | LABYRINTH CHOLLIMA |
| May 14, 2026 | PRESSURE CHOLLIMA theft via trojanized software in supply chain compromise; DPRK digital asset theft in 2025 (2026 Financial Services Threat Landscape Report) | | PRESSURE CHOLLIMA; DPRK-nexus groups |
| May 14, 2026 | FAMOUS CHOLLIMA and STARDUST CHOLLIMA targeting of fintechs, exchanges and banks (2026 Financial Services Threat Landscape Report) | North America, Europe, and Asia | FAMOUS CHOLLIMA; STARDUST CHOLLIMA |
| June 09, 2026 | DPRK adversaries targeting the technology sector; FAMOUS CHOLLIMA IT worker infiltration (2026 Technology Threat Landscape Report) | North America, Europe, and Asia | FAMOUS CHOLLIMA, LABYRINTH CHOLLIMA, and STARDUST CHOLLIMA |
| August 03, 2026 | STARDUST CHOLLIMA malicious npm dependency injected into at least 131 Mastra AI framework packages (June 2026) | | STARDUST CHOLLIMA |
| August 03, 2026 | FAMOUS CHOLLIMA AI supply chain compromise of cryptocurrency and blockchain companies (2026 Threat Hunting Report) | | FAMOUS CHOLLIMA |