| 2021-01-25T23:59:00+00:00 (datePublished) | Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects) | | government-backed entity based in North Korea |
| 2020-03-26T16:00:00+00:00 (datePublished) | North Korean (and Iranian) attackers impersonating news outlets or journalists | | attackers from Iran and North Korea |
| 2021-03-31T16:00:00+00:00 (datePublished) | Fake offensive security company "SecuriElite" set up to target security researchers | Turkey (claimed location of fake company) | North Korean government-backed entity |
| 2022-02 | On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-10 | Internet Explorer 0-day exploited by North Korean actor APT37 | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022-03-24T16:00:00+00:00 (datePublished) | Operation AppleJeus exploiting Chrome CVE-2022-0609 (compromised fintech websites) | U.S. based | North Korean group (Operation AppleJeus) |
| 2023-04-05T12:00:00+00:00 (datePublished) | ARCHIPELAGO (subset of APT43) phishing of North Korea policy experts | South Korea, the US and elsewhere | ARCHIPELAGO (subset of APT43) |
| 2023-09-07T15:00:00+00:00 (datePublished) | New campaign targeting security researchers with 0-day and fake debugging-symbols tool | | North Korean threat actors |