| 01.04.2004 | DDoS North Korea 2004 | Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of | Unknown |
| 01.03.2007 | Chemical Hack | Korea, Republic of;Korea, Republic of | Unknown |
| 2009-07 | 7.7 DDoS | United States, 🇰🇷 Korea, Republic of | |
| 2011-04 | NongHyup Bank | Korea, Republic of | |
| 2011-03 | 3.4 DDoS | Korea, Republic of, 🇺🇸 United States | |
| 01.09.2011 | North Korea vs. Inche on Airport | Korea, Republic of | South Korean Citizen;Reconnaissance General Bureau |
| 01.01.2011 | Retaliation for Kim Jong Il Hack | Korea, Republic of | Unknown |
| 01.01.2012 | North Korea espionage campaign | Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region) | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 2013-06 | 6.25 Cyber Terror | Korea, Republic of | Lazarus |
| 2013-03 | 3.20 Cyber Terror | Korea, Republic of | WHOis Team |
| September 2013 | CSIS entry 1058 | | |
| 01.01.2013 | Operation“Kimsuky” | Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;China;China;China;China | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2014-12 | Sony Pictures Entertainment | United States | Lazarus |
| 2014-12 | Korea Hydro and Nuclear Power | Korea, Republic of | Kimsuky |
| 2014-07 | Seoul Metro | Korea, Republic of | |
| 01.01.2014 | Reaper/APT37 vs. South Korean Targets | Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Democratic People's Republic of;Korea, Democratic People's Republic of;Korea, Democratic People's Republic of;Korea, Democratic People's Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067;Group123 |
| 01.01.2014 | North korea prepare to attack against SK | Korea, Republic of;Korea, Republic of | Unknown |
| October 2015 | CSIS entry 990 | | |
| 01.10.2015 | North Korean Lazarus group conducts operations against banks in Vietnam and the Philippines starting in October 2015 | Philippines | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Reconnaissance General Bureau |
| 2018-10 | FASTCash | ZZZ | Hidden Cobra |
| 2016-10 | Komisja Nadzoru Finansowego | Poland | Bluenoroff |
| 2016-08 | Defense Network | Korea, Republic of | Andariel |
| 2016-04 | DSME#1 | Korea, Republic of | Andariel |
| 2016-02 | Bangladesh Central Bank | Bangladesh | Bluenoroff |
| March 2016 | CSIS entry 977 | | |
| 2017-12 | Youbit | Korea, Republic of | Bluenoroff |
| 2017-10 | Central American Online Casino | | Bluenoroff |
| 2017-10 | Far Eastern International Bank | Taiwan | Bluenoroff |
| 2017-05 | WannaCry Ransomware | ZZZ, 🇷🇺 Russian Federation, 🇯🇵 Japan, 🇬🇧 United Kingdom, 🇫🇷 France, 🇰🇷 Korea, Republic of, 🇮🇳 India, 🇨🇳 China, 🇩🇪 Germany, 🇪🇸 Spain, 🇮🇩 Indonesia, 🇧🇷 Brazil, 🇺🇸 United States | Lazarus |
| 2017-04 | Yapizon | Korea, Republic of | Bluenoroff |
| October 2017 | CSIS entry 892 | | |
| 2017-08 | The Blockbuster Saga Continues | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 01.09.2017 | North Korean Lazarus group conducts Operation Sharpshooter against organziations in global defense and critical infrastructure since September 2017 | United States;United States;United States;United States | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.04.2017 | Lazarus (NorthKorea) attacks endusers because of financial interests | Unknown;Unknown | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2017 | Reaper vs. Japan/Vietnam/Middle East | Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Vietnam;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Japan;Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region);Middle East (region) | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067;Group123 |
| 01.01.2017 | Lazarus Bitcoin Hijack | Korea, Republic of | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Reconnaissance General Bureau |
| 2019-09 | Indian Financial Institute | India | Lazarus |
| 2018-12 | RedBanc | Chile | Hidden Cobra |
| 2018-08 | Cosmos Bank | India | Bluenoroff |
| 2018-06 | Bithumb#3 | Korea, Republic of | Bluenoroff |
| 2018-05 | Banco de Chile | Chile | Bluenoroff |
| 2018-05 | Sejong Institue | Korea, Republic of | Andariel |
| 01.01.2018 | NavRAT | Korea, Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 01.06.2018 | Andariel Group attacks website of South Korean non-profit organisation | Korea, Republic of;Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2018-04 | The first artefacts we found relating to MATA were used around April 2018. After that, the actor behind this advanced malware framework used it aggressively to infiltrate corporate entities around the world. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2019-10 | Kudankulam Nuclear Power Plant | India | Lazarus |
| 01.01.2019 | Lazarus turns against Russia | Russia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.09.2019 | Operation In(ter)ception | Europe (region);Middle East (region) | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.07.2019 | Fractured Statue | United States | TA406/Konni Group/Opal Sleet fka OSMIUM < Kimsuky |
| October 2019 | AppleJeus Version 2: JMT Trading (trojanized cryptocurrency application) | | HIDDEN COBRA |
| 01.01.2020 | ThreatNeedle: Defense Industries | Unknown | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-01-25T23:59:00+00:00 (datePublished) | Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects) | | government-backed entity based in North Korea |
| 23/12/20 | Undisclosed pharmaceutical company | N/A | Lazarus Group |
| 01.09.2020 | Unidentified North Korean Hackers Gained Access to an Unnamed Company and Stole Data from the Korea Hydro & Nuclear Power (KHNP) Energy Company in September 2020 and June 2024 | Not available;Korea, Republic of | Unknown |
| 2023-01 | Seoul Central District Court | Korea, Republic of | Lazarus |
| 2022-07 | Maui Ransomware | United States, 🇯🇵 Japan | Andariel |
| 2021-06 | Seoul National University Hospital | Korea, Republic of | |
| 2021-06 | Korea Atomic Energy Research Institute | Korea, Republic of | |
| 01.01.2021 | State-sponsored North Korean hacking group Lazarus deployed newly discovered backdoor WinorDLL64 against unspecified South Korean targets since 2021 | Korea, Republic of | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.10.2021 | North Korean state-sponsored hacker group Lazarus gained access to the corporate network of an aerospace company in the Netherlands in October 2021 | Netherlands | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-03 | ScarCruft surveilling North Korean defectors and human rights activists | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| November 18, 2021 | TA406 credential theft campaigns (2021) against foreign policy experts, journalists and NGOs | | TA406 (part of Kimsuky / Thallium / Konni) |
| 2021-08-19T17:00:00+00:00 | New variant of Konni malware used in campaign targeting Russia | Russia | APT37 (Konni, potentially linked) |
| 01.11.2021 | BlueNoroff hackers steal crypto using fake MetaMask extension | United States;Russia;China;India;United Kingdom;Ukraine;Poland;Czech Republic;United Arab Emirates;Germany | Blue Noroff/APT38/Stardust Chollima/G0082/Sapphire Sleet fka COPERNICUM/Genie Spider < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.06.2021 | Kimsuky vs. South Korean think tanks | Korea, Republic of | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 01.05.2021 | DeathNote cluster | Korea, Republic of;Korea, Republic of;Latvia;Latvia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2021 | North Korean defector Kang Mi-Jin | Korea, Democratic People's Republic of;Korea, Democratic People's Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 2023-03 | 3CX | United States | UNC4736 |
| 2022-06 | Harmony Bridge | United States | |
| 2022-04 | Randolph Air Force Base | United States | Andariel |
| 2022-03 | Axie Infinity | Viet Nam | |
| 2022-02 | NASA | United States | Andariel |
| August 2023 | CSIS entry 201 | | |
| April 2022 | CSIS entry 353 | | |
| 01.11.2022 | Presumed North Korean Threat Actors Have Been Targeting Personal Email Accounts of About 100 High-Ranking South Korean Military And State Officials Since November 2022 | Korea, Republic of;Korea, Republic of;Korea, Republic of | Unknown |
| 01.10.2022 | North Korean state-sponsored APT Andariel stole data from unnamed South Korean defence manufacturer through accessing maintenance/repair partner, starting in October 2022 | Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.11.2022 | North Korean state-sponsored APT Lazarus Group hacked into unnamed South Korean defence company and stole data starting in November 2022 | Korea, Republic of | Unknown |
| 22.12.2022 | State-sponsored North Korean hacker group Andariel stole sensitive information from South Korean defense companies as well as research institutes and pharmaceutical companies since at least 22 December 2022 | Korea, Republic of;Not available;Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.07.2022 | North Korean State-Sponsored Hacking Group Lazarus Compromised Unnamed Software Vendor Starting In Mid-2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2022 | North Korean state-sponsored hacking group 'Lazarus' gained access to network of unspecified Spanish aerospace company beginning in 2022 | Spain | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.11.2022 | North Korean state-sponsored APT groups 'Ruby Sleet' and 'Diamond Sleet' compromised two arms manufacturers in Germany and Israel beginning in November 2022 | Israel;Germany | Ruby Sleet fka CERIUM;Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.12.2022 | North Korean state-sponsored hacking group Kimsuky targeted the staff of consulting firm Korea Risk Group (KRG) and other organizations in the United States, Europe and Asia since December 2022 | Korea, Republic of;Asia (region);Asia (region);Europe (region);Europe (region);United States;United States | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 01.07.2022 | North Korean state-sponsored hacker group ScarCruft used RokRAT malware against unspecified Korean-speaking individuals beginning in July 2022 | Not available | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 01.07.2022 | The North Korean state-sponsored hacking group Lazarus gained access into the networks of a defence contractor in Africa and stole data using the DeathNote malware beginning in July 2022 | Africa | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.06.2022 | North Korean state-sponsored hacking group UNC2970 targeted US and European media and technology companies since at least June 2022 | Europe (region);Europe (region);United States;United States | TEMP.Hermit/ UNC577 < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Lab 110) |
| 21.10.2022 | North Korean state-sponsored hacking group Lazarus gained access to two computers at a financial organisation beginning on 21 October 2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.05.2022 | North Korean state-sponsored hacking group Lazarus gained access to the network of a financial organisation in May 2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| between May and November 2022 | “No Pineapple” campaign (Zimbra exploitation; 100 GB stolen) | | Lazarus Group |
| 02.09.2022 | Financially-motivated hacker group BlueNoroff compromised a company employee in the United Arab Emirates beginning in September 2022 | United Arab Emirates | Blue Noroff/APT38/Stardust Chollima/G0082/Sapphire Sleet fka COPERNICUM/Genie Spider < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2022-09-07T12:01:00.000Z | MagicRAT: Lazarus’ latest gateway into victim networks | | |
| 19 May 2022 | Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped) - ASEC BLOG (ahnlab.com) | | Lazarus Group |
| 2022-11-15T10:00:28 | DTrack activity targeting Europe and Latin America | | |
| 2022-09-29T16:00:00+00:00 (published_time) | ZINC weaponizing open-source software (PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, muPDF/Subliminal Recording) via LinkedIn/WhatsApp | US, UK, India, and Russia | ZINC (now Diamond Sleet) |
| 2022-09-14 (datePublished) | UNC4034 job opportunity phishing via WhatsApp with trojanized PuTTY (AIRDRY.V2) at a media company | | UNC4034 (suspected North Korea nexus) |
| 01.02.2022 | Between February and July 2022, the North Korean group Lazarus targeted organizations, including energy service providers worldwide | Global (region);Canada;United States;Japan | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-11 | CyberLink | Taiwan | Diamond Sleet |
| 2023-11 | HTX | Seychelles | Lazarus |
| 2023-09 | Stake.com | Australia | Lazarus |
| 2023-07 | Alphapo | Saint Vincent and the Grenadines | Lazarus |
| 2023-07 | CoinsPaid | Estonia | Lazarus |
| 2023-06 | JumpCloud | United States | UNC4899 |
| 2023-06 | Atomic Wallet | Estonia | Lazarus |
| 2023-03 | MagicLine | Korea, Republic of | Lazarus |
| 01.12.2023 | The North Korean state-aligned hacking group Moonstone Sleet compromised a defence technology company and stole credentials as well as intellectual property in early December 2023 | Not available | Moonstone Sleet / Storm-1789 |
| 01.04.2023 | North Korean state-sponsored APT Kimsuky stole technical data from unnamed South Korean defence company via email hack from April to July 2023 | Korea, Republic of | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 01.12.2023 | North Korean threat groups compromised South Korean Semiconductor companies in late 2023 and early 2024 | Korea, Republic of | Unknown |
| 01.08.2023 | North Korean State-Sponsored Hacker Group Lazarus Exploited Windows Zero-Day Vulnerability in Admin-to-Kernel Operation going back to at least August 2023 | Asia (region);Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2023 | North Korean hackers infiltrated email account of staff member of Office of South Korean President | Korea, Republic of | Unknown |
| 2023-12-11T13:50:59.000Z | Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang | | |
| 2023-11 | Kimsuky Targets South Korean Research Institutes with Fake Import Declaration | | Kimsuky, Velvet Chollima |
| 2023-08-22 | Andariel 그룹의 새로운 공격 활동 분석 | | Andariel; Kimsuky; Lazarus |
| 01.10.2023 | North Korean state-sponsored hacking group Diamond Sleet compromised vulnerable TeamCity servers since early October 2023 | Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2023 | North Korean state-sponsored APT group 'Diamond Sleet' compromised defence companies in several countries in January 2023 | Norway;Finland;Italy;Brazil;Poland;Czech Republic | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.03.2023 | North Korean APT group 'Onyx Sleet' targeted Russian University in March 2023 | Russia;Russia | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.03.2023 | North-Korean APT group 'Ruby Sleet' targeted Russian aerospace research institute in March 2023 | Russia | Ruby Sleet fka CERIUM |
| 01.01.2023 | North Korean state-sponsored hacking group Labyrinth Chollima gained access to network of unnamed Latin American banking company using QRLOG malware beginning in January 2023 | South America;Central America (region) | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-08-24T12:04:22.000Z | Lazarus Group's infrastructure reuse leads to discovery of new malware | | |
| 2023-07 | Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-06-28T10:00:24 | Andariel’s silly mistakes and a new malware family | | |
| 01.05.2023 | North Korean state-sponsored hacking group Kimsuky stole documents from unspecified victims in May 2023 | Not available | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 21/06/2023 | Multiple organizations | N/A | APT37 (AKA StarCruft, Reaper, or RedEyes) |
| Not available | Lazarus Group targeted Windows IIS Web Servers in Global Campaign | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| over the last couple of years (as of 20 March 2023) | Kimsuky spear phishing against Korean and German entities | South Korea; Germany | KIMSUKY (Thallium, Velvet Chollima) |
| 01.01.2023 | APT37 uses M2RAT backdoor for intelligence collection purposes on unspecified individuals since 2023 | Not available | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| February 09, 2023 | DPRK ransomware attacks on Healthcare and Public Health and other critical infrastructure | | DPRK cyber actors |
| 2024-10 | Play Ransomware | | Andariel |
| 2024-10 | Radiant Capital | Hong Kong | Citrine Sleet |
| 2024-09 | Indodax#2 | Indonesia | Lazarus |
| 2024-07 | WazirX | India | Lazarus |
| 2024-05 | FakePenny Ransomware | ZZZ | Moonstone Sleet |
| 2024-01 | D2 Innovation | Korea, Republic of | Kimsuky |
| 01.01.2024 | North Korean IT Worker from the State-Sponsored Fraud Group NICKEL TAPESTRY Stole Proprietary Data in Mid-2024 | Not available | NICKEL TAPESTRY |
| 01.08.2024 | North Korean state-sponsored hacking group Stonefly launched an attack on US companies in August 2024 | United States | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2024 | North Korean state-sponsored hacking group APT37 delivered a previously undocumented backdoor and remote access trojan called VeilShell to targets in Cambodia in 2024 | Cambodia | APT37 |
| 01.06.2024 | The North Korean state-sponsored hacking group UNC2970 gained access to a multinational energy company in June 2024 | Not available | Unknown |
| 19.08.2024 | North Korean Hacker Group Citrine Sleet Exploits Chromium Zero-Day Vulnerability on 19 August 2024 | United States | Unknown |
| 01.06.2024 | Lazarus APT group exploited a zero-day vulerability in early June 2024 against unspecified targets | Not available | Unknown |
| 01.01.2024 | North Korean hackers target South Korean defense contractor on 8 August 2024 | Korea, Republic of | Unknown |
| 01.04.2024 | North Korean APT Group Andariel targeted South Korean construction and machinery companies in April 2024 | Korea, Republic of;Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.05.2024 | The North Korean state-aligned hacking group Moonstone Sleet compromised an aircraft parts manufacturer in May 2024 | Not available | Unknown |
| 01.04.2024 | The North Korean state-aligned hacking group Moonstone Sleet compromised a drone technology company in April 2024 | Not available | Moonstone Sleet / Storm-1789 |
| 01.02.2024 | The North Korean state-aligned hacking group Moonstone Sleet has been infecting unnamed individuals or organisations with, among other things, the malware uploader YouieLoad since February 2024 | Not available | Unknown |
| 21.02.2024 | North Korean state-sponsored hacker group Kimsuky exploited vulnerabilities to gain access to ScreenConnect customer systems since at least 21 February 2024 | Not available | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 05.01.2024 | Lazarus Group suspected of having drained $7.5 million from crypto payment service provider CoinsPaid on 5 January 2024 | Estonia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| Not available | North Korean State-Sponsored Hacking Group APT37 Stole Advertising Content From a South Korean Ad Agency to Target End Users in 2024 | Korea, Republic of;Korea, Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| Not available | The North Korean state-aligned hacking group Moonstone Sleet delivered malicious npm packages to a victim with an associated project and stole its credentials | Not available | Moonstone Sleet / Storm-1789 |
| Not available | North Korean state-integrated hacking group Lazarus gained access to networks of defence and maritime companies | Not available;Not available;Hungary | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |