| Reporting Date: 18 June 2020 | Global COVID 19-related phishing campaign by North Korean operatives Lazarus Group | Singapore; Japan; South Korea (and three other nations) | Lazarus Group |
| 2020-05-15T00:00:43+00:00 | State-sponsored hacker groups join forces to capitalize on COVID-19 pandemic | | Lazarus Group (APT38, Hidden Cobra); APT37 (Reaper) |
| 2023-12-11T13:50:59.000Z | Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang | | |
| 29/09/2023 | Undisclosed Spanish aerospace company | ES | Lazarus Group (AKA HIDDEN COBRA) |
| 08/11/2023 | IT Job Seekers | >1 | BlueNoroff (AKA APT38, Sapphire Sleet, CageyChameleon, and CryptoCore) |
| 2023-06-28 | 크롬 원격 데스크톱을 악용하는 Kimsuky 공격 그룹 | | Kimsuky; 김수키 |
| Q4 2023 (from title: APT QUARTERLY HIGHLIGHTS : Q4 - 2023) | Operation Dream Magic (MagicLine4NX exploitation via compromised news website) | | Lazarus group |
| 21.02.2024 | North Korean state-sponsored hacker group Kimsuky exploited vulnerabilities to gain access to ScreenConnect customer systems since at least 21 February 2024 | Not available | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2024-06-27 | Kimsuky Deploys TRANSLATEXT Chrome Extension |ThreatLabz | | |
| 2024-09-26T03:00:51 | Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy | | |
| Q1 2024 (from title: APT Quarterly Highlights : Q1 - 2024) | Lazarus exploitation of Windows kernel vulnerability to enhance FudModule rootkit; Kimsuky PyPI supply chain | APAC region | Lazarus Group; Kimsuky |
| Q2 2024 (from title: APT Quarterly Highlights : Q2 2024) | Moonstone Sleet, Lazarus Kaolin RAT and Kimsuky Gomir/ReconShark activity | South Korea | Kimsuky (Springtail); Moonstone Sleet (Storm-1789); Lazarus Group; Andariel |
| Q3 2024 (from title: APT QUARTERLY HIGHLIGHTS - Q3 2024) | Konni threat campaign against Korean and Russian government entities | South Korea; Russia | Konni (linked to Kimsuky) |
| Q2 2026 (from title: APT QUARTERLY REPORT : APR TO JUN 2026) | Lazarus Group Q2 2026 campaigns against cryptocurrency exchanges, software vendors, defense contractors | | Lazarus Group |
| Q2 2026 (from title: APT QUARTERLY REPORT : APR TO JUN 2026) | Kimsuky Q2 2026 espionage operations | | Kimsuky |
| (no date on page) | From North Korean Phishing to Underground Online Hosting Services (Konni campaigns) | Bulgaria (hosting IP range) | APT37 (suspected); Konni |
| (no date on page) | Spear Phishing Attack by N. Korean Hacking Group, Kimsuky | Japan; United States; Russia; European nations; South Korea | Kimsuky (aka Velvet Chollima, Black Banshee, Thallium) |
| (no date on page) | Tracking DangerousPassword Campaign by Lazarus Group | North America; Europe; East Asia | Lazarus Group |
| (no date on page) | NukeSped RAT Report | US; South Korea; Japan; Asia Pacific countries | Lazarus Group (North Korea) |
| (no date on page) | Lazarus Group Recent Trends (13 campaigns observed in 2022) | United States; Japan; Singapore; India; United Kingdom | Lazarus Group |
| (no date on page) | Analysis of Konni RAT: Stealth, Persistence, and Anti-Analysis Techniques | Russia; East Asia; Europe; Middle East | APT37 (Konni) |
| (no date on page) | DPRK Sanctions Violations in Cyber Operations Post UN Panel Demise (2024 cryptocurrency theft; Bybit; DMM Bitcoin) | | North Korean hackers; DPRK cyber actors |