DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

FBI FLASH AC-000001-MW "North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities" (08 January 2026) (5)

Date (as written)IncidentCountryActors
As of 2025Kimsuky "quishing" (malicious QR code) spearphishing against think tanks, academia, governmentsKimsuky
In May 2025Spoofed foreign advisor email to a think tank leader with QR codeKimsuky
Later that month (May 2025)Spoofed embassy employee email to a think tank senior fellow (North Korean human rights)Kimsuky
Also in May 2025Spoofed think tank employee email with QR code to Kimsuky infrastructureKimsuky
In June 2025Fake conference invitation to a strategic advisory firm leading to fake Google loginKimsuky