| 2025-02-12 (datePublished) | APT38 thefts from financial institutions incl. SWIFT compromises | worldwide | APT38 |
| 2025-02-12 (datePublished) | TraderTraitor theft from a Japan-based company (as reported in December 2024 FBI/DC3/NPA statement) | Japan-based | UNC4899 (TraderTraitor) |
| 2025-02-12 (datePublished) | UNC3782 cryptocurrency crime and targeting of South Korean organizations combating crypto crime | South Korean | UNC3782 (suspected North Korean) |
| 2025-02-12 (datePublished) | North Korean cryptocurrency theft 2017-2023 (UN estimate cited) | | North Korea |
| 2025-03-06 (datePublished) | North Korean IT workers: global expansion, extortion and data leak operations | U.S.; Europe and Asia | North Korean IT workers |
| 2025-04-01 (datePublished) | DPRK IT worker operations expanding to Europe (one worker with 12 personas targeting defense and government) | Europe and the United States; United Kingdom; Germany and Portugal | DPRK IT workers |
| 2025-04-01 (datePublished) | DPRK IT worker extortion attempts against larger organizations (since late October 2024) | | DPRK IT workers |
| Cloud Threat Horizons Report H2 2025 (no exact date on page) | UNC4899 social-engineering intrusions into Google Cloud and AWS environments leading to cryptocurrency theft (Q3 2024 to Q1 2025) | | UNC4899 (TraderTraitor) |
| 2025-10-16 (datePublished) | UNC5342 EtherHiding (JADESNOW / INVISIBLEFERRET) in Contagious Interview campaign | | UNC5342 |
| 2025-11-05 (datePublished) | UNC1069 (MASAN) misuse of Gemini and deepfake lures distributing BIGMACHO | | UNC1069 (aka MASAN) |
| 2025-11-05 (datePublished) | UNC4899 (PUKCHONG) misuse of Gemini | | UNC4899 (aka PUKCHONG) |
| 2026-03 | Axios | | Bluenoroff |
| 2026-02-09 (datePublished) | UNC1069 intrusion at a FinTech entity using compromised Telegram account, fake Zoom meeting and deepfake | | UNC1069 |
| Cloud Threat Horizons Report H1 2026 (no exact date on page) | UNC4899 Kubernetes compromise and cryptocurrency theft from a cryptocurrency organization (2025) | | UNC4899 |
| 2026-02-10 (datePublished) | Suspected APT45 SMALLTIGER operation against South Korean defense, semiconductor, and automotive manufacturing | South Korean | APT45 (suspected) |
| 2026-02-10 (datePublished) | Suspected APT43 infrastructure mimicking German and U.S. defense-related entities (THINWAVE) | German and U.S. | APT43 (suspected) |
| 2026-02-10 (datePublished) | UNC2970 defense targeting and Gemini-assisted target profiling | | UNC2970 |
| 2026-02-10 (datePublished) | DPRK IT worker hired via facilitator for US government defense program contract (Vong case) | Maryland; Virginia | suspected DPRK IT worker |
| 2026-09-08 (datePublished) | DPRK AI misuse: IT worker bulk LLM API registration; MIDNIGHT NEPTUNE (formerly UNC1069) AI-enabled cryptocurrency theft | | MIDNIGHT NEPTUNE (formerly UNC1069); DPRK IT worker cluster |