DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

CSIS Significant Cyber Incidents (80)

Date (as written)IncidentCountryActors
2009-077.7 DDoSUnited States, 🇰🇷 Korea, Republic of
2013-033.20 Cyber TerrorKorea, Republic ofWHOis Team
September 2013CSIS entry 1058
2014-12Sony Pictures EntertainmentUnited StatesLazarus
On December 2 and 3, 2014Spear-phishing of AMC Theatres employeesU.S.JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
October 2015CSIS entry 990
2018-10FASTCashZZZHidden Cobra
2016-08Defense NetworkKorea, Republic ofAndariel
2016-04DSME#1Korea, Republic ofAndariel
March 2016CSIS entry 977
2017-10Central American Online CasinoBluenoroff
October 2017CSIS entry 892
August 2017CSIS entry 905
2017-08The Blockbuster Saga ContinuesLazarus Group, Hidden Cobra, Labyrinth Chollima
June 2017CSIS entry 918
April 2017CSIS entry 931
2018-12RedBancChileHidden Cobra
2018-12GBNKCenterKorea, Republic of
2018-08Cosmos BankIndiaBluenoroff
2018-05Sejong InstitueKorea, Republic ofAndariel
December 2018CSIS entry 779
September 2018CSIS entry 814
May 2018CSIS entry 842
2018-04Operation “GhostSecret”Lazarus Group, Hidden Cobra, Labyrinth Chollima
March 2018CSIS entry 867
March 2018CSIS entry 868
2019-10Kudankulam Nuclear Power PlantIndiaLazarus
2019-12-30T20:18:41+00:00 (published_time)Thallium spear-phishing; Microsoft court order seizes 50 domainsU.S., as well as Japan and South KoreaThallium
October 2019CSIS entry 674
Sep 2019Autumn Aperture—malware embedded in antiquated file typesUnnamed U.S.-based entitiesKimusky
21/08/2019North Korea?>1?
July 2019CSIS entry 712
2019-03-27라자루스(Lazarus) 그룹, 이스라엘 군수업체 대상 APT 역습Lazarus; 라자루스
March 2019CSIS entry 747
February 2019CSIS entry 752
01.01.2019Lazarus turns against RussiaRussiaLazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
January 2019CSIS entry 760
2020/11/16Lazarus supply-chain attack in South Korea
Since February 2020Resumed bank targeting: fraudulent international money transfers and ATM cash outsBeagleBoyz
18 Feb 2021Lazarus: Three North Koreans Charged for Financially Motivated Attacks
2021-05-31T17:00:00+00:00Kimsuky APT continues to target South Korean government using AppleSeed backdoorSouth KoreaKimsuky (Thallium, Black Banshee, Velvet Chollima)
01.01.2020ThreatNeedle: Defense IndustriesUnknownLazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
2021-01-25T23:59:00+00:00 (datePublished)Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects)government-backed entity based in North Korea
02/12/20Six pharmaceutical companies including Johnson & Johnson, Novavax Inc., Genexine Inc., Shin Poong Pharmaceutical Co. and Celltrion Inc.>1North Korean hackers
November 2020CSIS entry 539
2020-11-13T13:59:58+00:00 (published_time)Cerium targeting Covid-19 vaccine and treatment researchers (WHO-themed spear-phishing)Canada, France, India, South Korea and the United States (all three actors combined)Cerium
27/10/2020Individuals and organizations in South Korea, Japan, and the United States>1?
October 2020CSIS entry 557
23/12/20Undisclosed pharmaceutical companyN/ALazarus Group
mid-March 2020“Security alert”-themed spear-phishing of 28 individuals including 11 officials from six Security Council membersKimsuky advanced persistent threat group
August 13, 2020Operation ‘Dream Job’ Widespread North Korean Espionage Campaign
June 2020CSIS entry 612
June 2020CSIS entry 615
March 2020CSIS entry 639
February 2020CSIS entry 646
2021-06Korea Atomic Energy Research InstituteKorea, Republic of
January 2022CSIS entry 396
December 2021CSIS entry 401
September 2021CSIS entry 422
2021-03-31T16:00:00+00:00 (datePublished)Fake offensive security company "SecuriElite" set up to target security researchersTurkey (claimed location of fake company)North Korean government-backed entity
February 2021CSIS entry 509
2023-033CXUnited StatesUNC4736
2022-03Axie InfinityViet Nam
August 2023CSIS entry 201
April 2022CSIS entry 353
2022-02On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609.Lazarus Group, Hidden Cobra, Labyrinth Chollima
February 2022CSIS entry 384
October 2023CSIS entry 165
August 2023CSIS entry 190
June 2023CSIS entry 219
April 2023CSIS entry 237
2023-04-05T12:00:00+00:00 (datePublished)ARCHIPELAGO (subset of APT43) phishing of North Korea policy expertsSouth Korea, the US and elsewhereARCHIPELAGO (subset of APT43)
March 2023CSIS entry 246
02/02/2023Organizations in medical research, healthcare, chemical engineering, energy, defense, and a leading research university>1Lazarus Group
2025-02BybitUnited Arab EmiratesLazarus
published 2025-12-04Upbit hot wallet breachSouth Koreaa North Korean group like the Lazarus Group (believed)
2025/10/23Gotta fly: Lazarus targets the UAV sector
April 2025CSIS entry 71
February 2025CSIS entry 74
2026-04KelpDAO / LayerZeroIndiaTrader Traitor