| 2013-06 | 6.25 Cyber Terror | Korea, Republic of | Lazarus |
| 01.01.2013 | Operation“Kimsuky” | Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;China;China;China;China | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2014-12 | Sony Pictures Entertainment | United States | Lazarus |
| October 2015 | CSIS entry 990 | | |
| since at least 2015 | BeagleBoyz attempted thefts total | | BeagleBoyz (overlap: Lazarus, APT38, Bluenoroff, Stardust Chollima) |
| 10/09/2015 | South Korea | KR | North Korea |
| 05/10/2015 | South Korea | KR | North Korea |
| 2015-11-18T16:25:41 | TDrop2 Attacks Suggest Dark Seoul Attackers Return | | |
| 2018-10 | FASTCash | ZZZ | Hidden Cobra |
| 2016-08 | Defense Network | Korea, Republic of | Andariel |
| 2016-07 | Union Bank of India | India | Bluenoroff |
| 2016-05 | SK/Hanjin | Korea, Republic of | Andariel |
| 2016-04 | DSME#1 | Korea, Republic of | Andariel |
| 2016-03 | Interpark | Korea, Republic of | Andariel |
| March 2016 | CSIS entry 977 | | |
| 2016-03 | Operation “Daybreak” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| Aug 2016 | Compromise of computer networks associated with diplomats, journalists, and others in South Korea | South Korea | |
| since 2016 | FALLCHILL malware campaign (aerospace, telecommunications, finance) | | HIDDEN COBRA |
| 27/04/2016 | Several Targets in Asia | >1 | North Korea? |
| 20/05/2016 | Bank in Ecuador | EC | North Korea? |
| 07/09/2016 | Project on Crowdsourced Imagery Analysis (geo4nonpro.org) | US | North Korea? |
| 2017-12 | Unknown POS | Korea, Republic of | Lazarus |
| 2017-10 | Central American Online Casino | | Bluenoroff |
| October 2017 | CSIS entry 892 | | |
| August 2017 | CSIS entry 905 | | |
| 2017-08 | The Blockbuster Saga Continues | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| June 2017 | CSIS entry 918 | | |
| 2017-12-15 | Bitcoin Insiders in London | United Kingdom of Great Britain and Northern Ireland | NGB 3rd Technical Surveillance Bureau |
| 01/01/2017 | Several Institutions in the British Government | GB | >1 |
| 13/02/2017 | Several Banks Worldwide | >1 | Lazarus APT |
| 23/02/2017 | South Korea? | KR | North Korea? |
| 03/04/2017 | South Korean users in the public sector | KR | North Korea? |
| 05/04/2017 | South Korea and United States | KR US | North Korea |
| 03/05/2017 | Assets related to North Korea | >1 | ? |
| 09/05/2017 | Unnamed Target | N/A | ? (linked to North Korea?) |
| 08/08/2017 | Several North Korean Organizations | KP | ? |
| 11/09/2017 | South Korea | >1 | North Korea |
| 10/10/2017 | South Korea-US Operational Plan | US KR | ? |
| 20/11/2017 | South Korea | KR | The Lazarus Group |
| 2019-09 | Indian Financial Institute | India | Lazarus |
| 2018-12 | RedBanc | Chile | Hidden Cobra |
| 2018-05 | Sejong Institue | Korea, Republic of | Andariel |
| 2018-01 | Metrolinx | Canada | |
| December 2018 | CSIS entry 779 | | |
| March 2018 | CSIS entry 867 | | |
| 01.01.2018 | NavRAT | Korea, Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 01.06.2018 | Andariel Group attacks website of South Korean non-profit organisation | Korea, Republic of;Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2/1/2019 | Babyshark - US | US / N Korea | |
| 2018-08 | Operation “AppleJeus” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-11 | More Attacks on Cryptocurrency Businesses | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-02-20 (datePublished) | APT37 (Reaper) operations incl. zero-days and wiper malware | Primarily South Korea – though also Japan, Vietnam and the Middle East | APT37 (Reaper; Scarcruft; Group123) |
| 29/05/2018 | Multiple Targets | US | Hidden Cobra |
| 02/01/2018 | Unnamed South Korean Company | KR | Andariel |
| 08/01/2018 | Single Individuals | >1 | ? |
| 16/01/2018 | Multiple targets mainly in South Korea | KR | Group 123 |
| 16/01/2018 | Several cryptocurrency exchanges such as Coinlink. | >1 | ? |
| 2018-02-02 | 금성121, Flash Player Zero-Day (CVE-2018-4878) 공격 주의 | | Geumseong121; 금성121 |
| 06/02/2018 | Multiple Targets | >1 | Hidden Cobra, aka Lazarus Group |
| 12/02/2018 | Bitcoin users and global financial organizations. | >1 | Hidden Cobra, aka Lazarus Group |
| 31/05/2018 | South Koreans | KR | Andariel Group |
| 14/06/2018 | Multiple Targets | US | Hidden Cobra |
| 15/06/2018 | Multiple Targets in Singapore | >1 | ? |
| 22/06/2018 | cryptocurrency exchanges | >1 | ? |
| 09/08/2018 | US Organizations | US | Hidden Cobra |
| 2018-09-27T08:00:04 | New KONNI Malware attacking Eurasia and Southeast Asia | | |
| 20/11/2018 | Latin American financial institutions | >1 | Lazarus Group |
| 2019-10 | Kudankulam Nuclear Power Plant | India | Lazarus |
| 2019-09 | Magyar Fejlesztési Központ | Hungary | |
| 2019-12-30T20:18:41+00:00 (published_time) | Thallium spear-phishing; Microsoft court order seizes 50 domains | U.S., as well as Japan and South Korea | Thallium |
| Sep 2019 | Autumn Aperture—malware embedded in antiquated file types | Unnamed U.S.-based entities | Kimusky |
| 21/08/2019 | North Korea? | >1 | ? |
| July 2019 | CSIS entry 712 | | |
| 01.01.2019 | Lazarus turns against Russia | Russia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.07.2019 | Fractured Statue | United States | TA406/Konni Group/Opal Sleet fka OSMIUM < Kimsuky |
| August 2019 | Targeting of retired South Korean diplomats, government and military officials | | Kimsuky |
| 2019-11-07 | Indian Space Research Organisation (ISRO) | India | NGB 3rd Technical Surveillance Bureau |
| 2019-05-13 | 북한 해커들, 데이터 탈취를 위해 ELECTRICFISH 사용해 | | HIDDEN COBRA; Hidden Cobra; Lazarus; 라자루스 |
| 2019-05-13T10:00:03 | ScarCruft continues to evolve, introduces Bluetooth harvester | | |
| 17/12/2019 | Multiple targets | >1 | The Lazarus Group |
| 10/04/2019 | Multiple Targets | >1 | Lazarus Group (AKA Hidden Cobra) |
| 05/08/2019 | Banks and cryptocurrency exchanges | >1 | North Korea |
| 09/09/2019 | Targets in the US | US | ? |
| 23/09/2019 | Research Centers in India | IN | Attackers from North Korea |
| 12/10/2019 | Mac owners working at cryptocurrency exchanges | >1 | Attackers from North Korea |
| 31/10/2019 | Multiple targets in the US | US | Hidden Cobra AKA Lazarus Group |
| 03/12/2019 | macOS users | >1 | Lazarus Group |
| 2020/11/16 | Lazarus supply-chain attack in South Korea | | |
| 2021-05-31T17:00:00+00:00 | Kimsuky APT continues to target South Korean government using AppleSeed backdoor | South Korea | Kimsuky (Thallium, Black Banshee, Velvet Chollima) |
| 01.01.2020 | ThreatNeedle: Defense Industries | Unknown | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-01-25T23:59:00+00:00 (datePublished) | Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects) | | government-backed entity based in North Korea |
| 02/12/20 | Six pharmaceutical companies including Johnson & Johnson, Novavax Inc., Genexine Inc., Shin Poong Pharmaceutical Co. and Celltrion Inc. | >1 | North Korean hackers |
| November 2020 | CSIS entry 539 | | |
| 2020-11-13T13:59:58+00:00 (published_time) | Cerium targeting Covid-19 vaccine and treatment researchers (WHO-themed spear-phishing) | Canada, France, India, South Korea and the United States (all three actors combined) | Cerium |
| 27/10/2020 | Individuals and organizations in South Korea, Japan, and the United States | >1 | ? |
| 23/12/20 | Undisclosed pharmaceutical company | N/A | Lazarus Group |
| mid-March 2020 | “Security alert”-themed spear-phishing of 28 individuals including 11 officials from six Security Council members | | Kimsuky advanced persistent threat group |
| 2020-03 | According to a tweet shared by South Korean cyber-security firm IssueMakersLab, a group of North Korean hackers also hid malware inside documents detailing South Korea's response to the COVID-19 epidemic. | | Kimsuky, Velvet Chollima |
| 2021-01-03 | 탈륨 조직, 사설 주식 투자 메신저 악용해 소프트웨어 공급망 공격 수행 | | 블루 에스티메이트; 탈륨 |
| 2020-01-08T10:00:47 | Operation AppleJeus Sequel | | |
| Since January 2020 | AppleJeus campaign against energy, finance, government, industry, technology and telecom sectors in 30+ countries | Argentina, Australia, Belgium, Brazil, Canada, China, Denmark, Estonia, Germany, Hong Kong, Hungary, India, Ireland, Israel, Italy, Japan, Luxembourg, Malta, the Netherlands, New Zealand, Poland, Russia, Saudi Arabia, Singapore, Slovenia, South Korea, Spain, Sweden, Turkey, the United Kingdom, Ukraine, and the United States | HIDDEN COBRA; Lazarus Group |
| 2020-05-12 (report date) | COPPERHEDGE / Manuscrypt targeting of cryptocurrency exchanges | | HIDDEN COBRA |
| 07/06/2020 | Multiple online stores | >1 | Lazarus Group AKA Hidden Cobra |
| early this year (report dated 2020-08-19) | Job-posting lure campaign against government/defense contractors (BLINDINGCAN) | | HIDDEN COBRA; "A threat group with a nexus to North Korea" |
| 03/03/2020 | South Korea | KR | Kimsuky |
| 2020-05-11 | Lazarus’ MacOS Dacls RAT Shows Multi-Platform Ability | | |
| 2020 | Campaign targeting the aeronautics and defence sectors (fake LinkedIn recruiters; ESET “Operation In(ter)ception”) | | Lazarus |
| 02/11/2020 | Multiple targets in the United States, Russia and Europe | >1 | Kimsuky (AKA Velvet Chollima, Black Banshee and Thallium) |
| 2021-11 | bZx | United States | Bluenoroff |
| 2021-06 | Korea Atomic Energy Research Institute | Korea, Republic of | |
| January 2022 | CSIS entry 396 | | |
| 2021-03-31T16:00:00+00:00 (datePublished) | Fake offensive security company "SecuriElite" set up to target security researchers | Turkey (claimed location of fake company) | North Korean government-backed entity |
| February 2021 | CSIS entry 509 | | |
| 2021-03 | ScarCruft surveilling North Korean defectors and human rights activists | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| November 18, 2021 | TA406 credential theft campaigns (2021) against foreign policy experts, journalists and NGOs | | TA406 (part of Kimsuky / Thallium / Konni) |
| 2021-08-19T17:00:00+00:00 | New variant of Konni malware used in campaign targeting Russia | Russia | APT37 (Konni, potentially linked) |
| 01.05.2021 | DeathNote cluster | Korea, Republic of;Korea, Republic of;Latvia;Latvia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2021 | North Korean defector Kang Mi-Jin | Korea, Democratic People's Republic of;Korea, Democratic People's Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 2021-11-10T22:11:00.000Z | North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets | | |
| 10/11/2021 | Security Researchers worldwide | >1 | Lazarus Group AKA HIDDEN COBRA |
| 2021-07-12 | 12th July – Threat Intelligence Report | | |
| Apr 2021 | Targeting of South African freight companies | South African shipping companies | Lazarus Group |
| 26/11/2021 | Employees at South Korean security companies | KR | Attackers from North Korea (Zinc) |
| 2021-08-17T16:15:15+00:00 (published_time) | InkySquid strategic web compromise of Daily NK delivering BLUELIGHT (late March to early June 2021) | South Korean | InkySquid (ScarCruft, APT37) |
| 2021-01-05T17:00:00+00:00 | Retrohunting APT37: VBA self decode technique to inject RokRat | | APT37 |
| 03/03/2021 | Multiple targets | >1 | Hidden Cobra AKA Lazarus Group |
| 2021-04-14T08:29:32+00:00 | Lazarus BTC Changer | | |
| 19/04/2021 | Targets in South Korea | KR | Lazarus Group AKA Hidden Cobra |
| 20/06/2021 | Daewoo Shipbuilding & Marine Engineering (DSME) | KR | Attackers from North Korea |
| 15/10/2021 | Security researchers | >1 | North Korean government threat actors |
| 14/12/2021 | Multiple organizations | >1 | Threat actors originating from China, Iran, North Korea, and Turkey |
| 2022-07 | H0lyGh0st Ransomware | United States | DEV-0530 |
| 2022-06 | Harmony Bridge | United States | |
| April 2022 | CSIS entry 353 | | |
| 2022-02 | On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 19 May 2022 | Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped) - ASEC BLOG (ahnlab.com) | | Lazarus Group |
| 2022-11-15T10:00:28 | DTrack activity targeting Europe and Latin America | | |
| 2022-09-29T16:00:00+00:00 (published_time) | ZINC weaponizing open-source software (PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, muPDF/Subliminal Recording) via LinkedIn/WhatsApp | US, UK, India, and Russia | ZINC (now Diamond Sleet) |
| 2022-09-14 (datePublished) | UNC4034 job opportunity phishing via WhatsApp with trojanized PuTTY (AIRDRY.V2) at a media company | | UNC4034 (suspected North Korea nexus) |
| 01.02.2022 | Between February and July 2022, the North Korean group Lazarus targeted organizations, including energy service providers worldwide | Global (region);Canada;United States;Japan | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2022-01 | North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022 Early | Tracing State-Aligned Activity Targeting Journalists, Media | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-08 | deBridge Finance crypto platform targeted by Lazarus hackers | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-08 | Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-09 | SlowMist: Investigation of North Korean APT’s Large-Scale Phishing Attack on NFT Users | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-07 | Operation “STIFF#BIZON” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022-09 | Meeting the “Ministrer” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022-10 | Internet Explorer 0-day exploited by North Korean actor APT37 | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022-12-27T08:00:26 | BlueNoroff introduces new methods bypassing MoTW | | |
| 2022-07-05 | Multiple organizations in Japan | Japan | NGB 3rd Technical Surveillance Bureau |
| 27 Apr 2022 | Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets | | |
| 18/04/2022 | Organizations in the cryptocurrency and blockchain industries | US | Lazarus Group AKA APT38 |
| 2022-01-13T09:00:23 | The BlueNoroff cryptocurrency hunt is still on | | |
| 2022-12-01T15:41:19+00:00 (published_time) | Lazarus Group AppleJeus campaign via fake BloxHolder cryptocurrency trading website and malicious Office documents | | Lazarus Group |
| 31/03/2022 | Cryptocurrency users and investors. | >1 | Lazarus Group |
| 2022-12-26 | 기자·국회의원실등 사칭 전자우편 발송사건, 북 해킹조직 소행으로 확인 | | |
| 2022-07-09T17:00:00+00:00 | North Korean APT targets US healthcare sector with Maui ransomware | United States | State-sponsored North Korean threat actors |
| 2022-07-28T09:39:56+00:00 (published_time) | SharpTongue SHARPEXT mail-stealing browser extension incidents (since September 2021) | | SharpTongue (Kimsuky) |
| 2022-08-25T01:00:31 | Kimsuky’s GoldDragon cluster and its C2 operations | | |
| 16/05/2022 | Multiple organizations worldwide | >1 | Democratic People’s Republic of Korea (DPRK) |
| 08/02/2022 | Organizations in South Korea | KR | Kimsuky AKA TA406 |
| 2022-03-24T16:00:00+00:00 (datePublished) | Operation AppleJeus exploiting Chrome CVE-2022-0609 (compromised fintech websites) | U.S. based | North Korean group (Operation AppleJeus) |
| 2022-04-26 | Lazarus Group APT Targeting South Korean Users | Zscaler | | |
| 04/08/2022 | Employees in the fintech industry | >1 | Lazarus Group |
| 2022/09/30 | Amazon-themed campaigns of Lazarus in the Netherlands and Belgium | | |
| 2022-10-24 | Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware | | Kimsuky |
| 2022/11/30 | Who’s swimming in South Korean waters? Meet ScarCruft’s Dolphin | | |
| 12/12/2022 | Foreign experts about North Korea | >1 | Kimsuky AKA Thallium |
| 2023-11 | CyberLink | Taiwan | Diamond Sleet |
| 2023-09 | CoinEx | United States | Lazarus |
| 2023-09 | Stake.com | Australia | Lazarus |
| 2023-07 | Alphapo | Saint Vincent and the Grenadines | Lazarus |
| 2023-07 | CoinsPaid | Estonia | Lazarus |
| 2023-06 | JumpCloud | United States | UNC4899 |
| 2023-06 | Atomic Wallet | Estonia | Lazarus |
| October 2023 | CSIS entry 165 | | |
| August 2023 | CSIS entry 190 | | |
| 2023-04-05T12:00:00+00:00 (datePublished) | ARCHIPELAGO (subset of APT43) phishing of North Korea policy experts | South Korea, the US and elsewhere | ARCHIPELAGO (subset of APT43) |
| 02/02/2023 | Organizations in medical research, healthcare, chemical engineering, energy, defense, and a leading research university | >1 | Lazarus Group |
| 2023-12-11T13:50:59.000Z | Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang | | |
| 2023-11 | Kimsuky Targets South Korean Research Institutes with Fake Import Declaration | | Kimsuky, Velvet Chollima |
| 2023-08-22 | Andariel 그룹의 새로운 공격 활동 분석 | | Andariel; Kimsuky; Lazarus |
| 01.10.2023 | North Korean state-sponsored hacking group Diamond Sleet compromised vulnerable TeamCity servers since early October 2023 | Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-08-24T12:04:22.000Z | Lazarus Group's infrastructure reuse leads to discovery of new malware | | |
| 2023-07 | Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-06-28T10:00:24 | Andariel’s silly mistakes and a new malware family | | |
| 21/06/2023 | Multiple organizations | N/A | APT37 (AKA StarCruft, Reaper, or RedEyes) |
| Not available | Lazarus Group targeted Windows IIS Web Servers in Global Campaign | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| over the last couple of years (as of 20 March 2023) | Kimsuky spear phishing against Korean and German entities | South Korea; Germany | KIMSUKY (Thallium, Velvet Chollima) |
| February 09, 2023 | DPRK ransomware attacks on Healthcare and Public Health and other critical infrastructure | | DPRK cyber actors |
| 2023-07-18T14:43:24+00:00 | Security alert: social engineering campaign targets technology industry employees | | Jade Sleet; TraderTraitor |
| 27/10/2023 | Undisclosed software vendor | N/A | Lazarus (aka Diamond Sleet and ZINC) |
| 2023-10 | Elastic catches DPRK passing out KANDYKORN | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-07 | Operation “STARK#MULE” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2023-05-04T13:55:19.000Z | Kimsuky Evolves Reconnaissance Capabilities in New Global Campaign | SentinelOne | | |
| 2023-11-10 | 자산 관리 프로그램을 악용한 공격 정황 포착 (Andariel 그룹) | | Andariel; Kimsuky; Lazarus |
| April 21 2023 (dateCreated 2023-04-21) | 'RustBucket' malware targets macOS | | BlueNoroff (sub-group of Lazarus Group) |
| 14/06/2023 | South Korea | KR | North Korea |
| (published 23 November 2023) | DPRK state-linked software supply chain attacks using zero-day vulnerabilities (NCSC-NIS joint advisory) | | DPRK state-linked cyber actors |
| 2023-03-21 | APT37 | ThreatLabz | | |
| 2023-03-30T11:37:54+00:00 (published_time) | 3CX Desktop App supply chain compromise (ICONIC) | | UTA0040, later attributed to Lazarus |
| 2023-05-01 | Chain Reaction: ROKRAT’s Missing Link | | |
| 10/05/2023 | Seoul National University Hospital (SNUH) | KR | North Korean threat actor (Kimsuky) |
| 2023-05-23T11:23:42.000Z | Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit | SentinelOne | | |
| June 1, 2023 | Impersonation of South Korean think tank researchers | South Korea | Kimsuky (Thallium, APT43, Velvet Chollima, Black Banshee) |
| 07/08/2023 | NPO Mashinostroyeniya | RU | ScarCruft |
| 29/09/2023 | Undisclosed Spanish aerospace company | ES | Lazarus Group (AKA HIDDEN COBRA) |
| 6 November 2023 | “BlueNoroff strikes again with new macOS malware,” Jamf Threat Labs | | BlueNoroff |
| 25/01/2023 | Crypto users | ES JP PL UK US | TA444 |
| 2023-02-14 | 스테가노그래피 기법 사용한 한글(HWP) 악성코드 : RedEyes(ScarCruft) | | APT37; RedEyes; ScarCruft |
| 2023-02-15 | Distribution of Malware Exploiting Vulnerable Innorix: Andariel | | Andariel |
| 2023-03-09 (datePublished) | UNC2970 job-recruitment phishing against Western media and technology companies (since June 2022) | U.S.-based; U.S. and European | UNC2970 (suspected UNC577 / Temp.Hermit) |
| 2023-03-28 (datePublished) | APT43 espionage and cryptocurrency theft to fund operations | South Korea, Japan, Europe, and the United States | APT43 (Kimsuky) |
| 2023-04-12T08:00:00 | Following the Lazarus group by tracking DeathNote campaign | | |
| 20/04/2023 | People working in software or DeFi platforms | >1 | Lazarus Group AKA Labyrinth Collima, Covellite, UNC4034, Zinc, Nickel Academy) |
| 06/06/2023 | Financial institutions and venture capital firms in Japan, Vietnam, and the United States | JP US VN | TAG-71 (APT38) |
| 29/06/2023 | Multiple organizations | >1 | BlueNoroff (part of the Lazarus Group) |
| 2023-07-27T05:00:00.000Z | More malicious npm packages found in wake of JumpCloud supply chain hack | | North Korea; Lazarus Group |
| 03/08/2023 | IT Professionals | >1 | Lazarus Group |
| 2023-08-12T22:25:00+00:00 | Sophisticated, Highly-Targeted Attacks Continue to Plague npm (campaign with behaviors similar to June North Korean campaign) | | North Korean state actors (June campaign) |
| 2023-09-07T15:00:00+00:00 (datePublished) | New campaign targeting security researchers with 0-day and fake debugging-symbols tool | | North Korean threat actors |
| 07/09/2023 | Russian government and defense organizations | RU | Multiple threat actors from North Korea |
| 2023-10-16 | RDP를 이용해 감염 시스템을 제어하는 Kimsuky 위협 그룹 | | Kimsuky |
| 08/11/2023 | IT Job Seekers | >1 | BlueNoroff (AKA APT38, Sapphire Sleet, CageyChameleon, and CryptoCore) |
| 20/11/2023 | Organizations in Russia | RU | Konni |
| 21/11/2023 | Multiple western organizations | >1 | Threat actors from North Korea |
| 2023-11-21 | 북 해킹조직의 정부기관·언론사 등 사칭 전자우편 주의 | | |
| 25/11/2023 | Indexed Finance | N/A | ? |
| 05/12/2023 | South Korean companies connected to the defense industry | KR | Andariel |
| 05/12/2023 | Three organizations in South Korea and abroad | KR N/A | Andariel |
| 2023-12-22 | Kimsuky 그룹의 AppleSeed 악성코드 공격 동향 분석 | | Kimsuky |
| 2024-10 | Play Ransomware | | Andariel |
| 2024-10 | Tapioca DAO | United States | Lazarus |
| 2024-07 | WazirX | India | Lazarus |
| 2024-06 | CoinStats | Armenia | |
| 2024-05 | AlexLab | Singapore | Lazarus |
| 2024-04 | eScan | India | Kimsuky |
| 2024-03 | Asung Soft | Korea, Republic of | Kimsuky |
| 2024-01 | D2 Innovation | Korea, Republic of | Kimsuky |
| 01.08.2024 | North Korean state-sponsored hacking group Stonefly launched an attack on US companies in August 2024 | United States | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2024 | North Korean state-sponsored hacking group APT37 delivered a previously undocumented backdoor and remote access trojan called VeilShell to targets in Cambodia in 2024 | Cambodia | APT37 |
| 19.08.2024 | North Korean Hacker Group Citrine Sleet Exploits Chromium Zero-Day Vulnerability on 19 August 2024 | United States | Unknown |
| 01.06.2024 | Lazarus APT group exploited a zero-day vulerability in early June 2024 against unspecified targets | Not available | Unknown |
| 01.01.2024 | North Korean hackers target South Korean defense contractor on 8 August 2024 | Korea, Republic of | Unknown |
| 21.02.2024 | North Korean state-sponsored hacker group Kimsuky exploited vulnerabilities to gain access to ScreenConnect customer systems since at least 21 February 2024 | Not available | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2024 | Operation “DEEP#GOSU” | | Kimsuky, Velvet Chollima |
| 2024-06-27 | Kimsuky Deploys TRANSLATEXT Chrome Extension |ThreatLabz | | |
| 2024-03 | Attack Activities by Kimsuky Targeting Japanese Organizations | | Kimsuky, Velvet Chollima |
| 2024-05 | North Korean Hackers Exploit Facebook Messenger in Targeted Malware Campaign | | Kimsuky, Velvet Chollima |
| 2024-07 | APT Group Kimsuky Targets University Researchers | | Kimsuky, Velvet Chollima |
| 2024-09 | North Korea Hackers Linked to Breach of German Missile Manufacturer | | Kimsuky, Velvet Chollima |
| 2024-05 | The Crypto Game of Lazarus APT: Investors vs. Zero-days | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2024-09-10T05:00:00.000Z | Fake recruiter coding tests target devs with malicious Python packages (VMConnect) | | Lazarus Group |
| 2024-09 | Kimsuky-linked hackers use similar tactics to attack Russia and South Korea, researchers say | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2024-08-29T19:31:00+00:00 | North Korea Still Attacking Developers via npm | | groups aligned with North Korean objectives |
| 2024-04 | Operation “DEV#POPPER” | | [Unnamed groups: North Korea] |
| July 25, 2024 | RGB 3rd Bureau (Andariel) global espionage against defense, aerospace, nuclear, engineering | | Andariel, Onyx Sleet (formerly PLUTONIUM), DarkSeoul, Silent Chollima, and Stonefly/Clasiopa (RGB 3rd Bureau) |
| 28/02/2024 | Organizations in Japan | JP | Lazarus |
| (published February 28, 2024) | Lazarus malicious npm package containing Comebacker (case reported by Phylum) | | Lazarus (as considered by JPCERT/CC) |
| 2024-09-18T14:00:59 | Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors | | |
| 21/08/2024 | Undisclosed organization(s) | Unknown | UAT-5394 linked to Kimsuky |
| 03/01/2024 | Multiple organizations within the cryptocurrency and the blockchain industries | >1 | TA444 (a.k.a. Sapphire Sleet, BLUENOROFF, STARDUST CHOLLIMA) |
| 23/07/2024 | KnowBe4 | US | Threat actors from North Korea |
| 2024-09-26T03:00:51 | Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy | | |
| 2024-12-19T10:00:55 | Lazarus group evolves its infection chain with old and new malware | | |
| 25/12/2024 | Multiple Organizations | >1 | ? |
| September 16 2024 | Jamf Threat Labs observes targeted attacks amid FBI warnings | | DPRK |
| 2024 | Social engineering (fake employment/investment offers) against DeFi and cryptocurrency firms | | North Korean state-sponsored actors |
| 02/05/2024 | Multiple organizations | >1 | APT43 (a.k.a. Kimsuky, Emerald Sleet, Velvet Chollima, and Black Banshee) |
| 1 October 2024 | North Korean IT workers offering remote services to companies worldwide | | North Korean intelligence services; IT workers |
| 2024-01-22T13:55:47.000Z | ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals | SentinelOne | | |
| 2024-02-14 | 북한 해커, 대통령실 행정관의 네이버 메일을 어떻게 해킹했나 | | |
| 14/02/2024 | Individuals in South Korea | KR | Gyeongheung |
| 19/02/2024 | Undisclosed research center for maritime and shipping technologies | N/A | Threat actor from North Korea |
| 19/02/2024 | Organization in the defense sector | N/A | Lazarus |
| 21/02/2024 | Russian Consular Department of the Ministry of Foreign Affairs (MID) | RU | Konni (a.k.a. Opal Sleet, Osmium, or TA406) |
| 2024-02-28 | Microsoft Windows의 보안 업데이트 권고 (CVE-2024-21338) | | Lazarus |
| 2024-03-04 | 北 , 국내 반도체 기업 해킹으로 설계도면과 현장사진 훔쳐갔다 | | |
| 21/03/2024 | Multiple organizations | N/A | Kimsuky a.k.a. Black Banshee,Thallium |
| 07/04/2024 | Multiple organizations | >1 | Vedalia (a.k.a. Konni) |
| April 16, 2024 | TA427 benign-conversation phishing of foreign policy experts with DMARC abuse (since 2023) | US; Republic of Korea (ROK or South Korea) | TA427 (Emerald Sleet, APT43, THALLIUM, Kimsuky) |
| 18/04/2024 | Individuals in the Asian region | >1 | Lazarus |
| 22/04/2024 | Multiple organizations in South Korea | KR | TA427, a.k.a. Emerald Sleet, APT43, THALLIUM or Kimsuky. |
| 2024-04-23 | 국내 방산업체 83곳 공격, 10여곳 해킹 [기사: 라자루스·안다리엘·김수키까지 北 해커조직 총동원... 국내 방산업체 83곳 공격해 10여곳 해킹] | | 라자루스; 안다리엘; 김수키 |
| 09/05/2024 | Two South Korean cryptocurrency firms | KR | Kimsuky |
| 16 May 2024 | Springtail: New Linux Backdoor Added to Toolkit | | |
| 2024-05-16 | Dora RAT을 이용한 국내 기업 대상 APT 공격 사례 분석 (Andariel 그룹) | | Andariel; Kimsuky; Lazarus |
| 28/05/2024 | Multiple organizations | >1 | Moonstone Sleet (previously tracked as Storm-1789) |
| 12/06/2024 | Cryptocurrency professionals in Brazil | BR | PUKCHONG a.k.a. UNC4899) |
| 12/06/2024 | Aerospace firms in Brazil | BR | PAEKTUSAN |
| 12/06/2024 | Diplomats in Brazil | BR | PRONTO |
| June 13, 2024 | A New North Korean Group Emerges, Disrupting the Open-Source Ecosystem (Moonstone Sleet npm packages) | | Moonstone Sleet; Jade Sleet |
| 2024-06-24 | 국내 기업 대상 공격에 사용 중인 Xctdoor 악성코드 (Andariel) | | Andariel; Kimsuky; Lazarus |
| 2024-06-26 | Kimsuky 그룹의 신규 백도어 등장 (HappyDoor) | | Kimsuky |
| 15/07/2024 | Job seekers in multiple countries | >1 | Threat actors from North Korea |
| 25/07/2024 | Organizations in the healthcare, energy and financial sectors | >1 | APT45 a.k.a. Andariel, Onyx Sleet, Stonefly, and Silent Chollima |
| 31/07/2024 | Multiple organizations across South Korea, North America, Europe, and the Middle East | KR >1 | Threat actors from North Korea |
| 2024-07-31T00:00:00Z | Stressed Pungsan: DPRK-aligned threat actor leverages npm for initial access | | Stressed Pungsan; MOONSTONE SLEET |
| 05/08/2024 | Construction and machinery companies in South Korea | KR | Kimsuky (APT43) and Andariel (APT45) |
| 13/08/2024 | Crypto investors | >1 | Lazarus |
| 16/08/2024 | Blockchain engineers | >1 | BlueNoroff |
| 2024-08-20T05:00Z (datePublished) | FAMOUS CHOLLIMA insider IT worker infiltration of U.S. technology companies (2024 Threat Hunting Report) | U.S. | FAMOUS CHOLLIMA |
| 03/09/2024 | Organizations in the cryptocurrency sector | >1 | Threat actors from North Korea |
| 2024-09-04T06:52:35+00:00 | APT Lazarus: Eager Crypto Beavers, Video calls and Games | Group-IB Blog | | |
| 09/09/2024 | Several unnamed South Korean enterprises, including a tax law firm. | RU | Konni (linked to the North Korean state-sponsored group Kimsuky) |
| 2024-09-17 (datePublished) | UNC2970 trojanized SumatraPDF job lures (MISTPEN via BURNBOOK) against energy and aerospace | U.S. | UNC2970 |
| 2024-09-19 | 강연의뢰서로 위장한 Kimsuky 그룹 악성코드(MSC, HWP) | | Kimsuky |
| 2024-10-09T03:00:54 | Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware | | |
| 13/10/2024 | Organizations in the financial space | >1 | Threat actors from North Korea (Hidden Cobra) |
| May 2024 | “Operation Code on Toast”: IE zero-day via pop-up “toast ads” against ROK national security officials and DPRK-related NGOs (RokRAT) | Republic of Korea | APT37 |
| 16/10/2024 | Undisclosed organization | Unknown | Threat actor from North Korea |
| 17/10/2024 | Multiple organizations in the cryptocurrency sector | >1 | Lazarus |
| 2024-10-24T00:00:00Z | Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview | US | Tenacious Pungsan |
| 04/11/2024 | Multiple organizations | >1 | Threat actors from North Korea |
| 2024-11-07T10:55:47.000Z | BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence | SentinelOne | | |
| 12/11/2024 | Multiple organizations | >1 | Threat actors from North Korea |
| 2024-11-13T05:55:12+00:00 | Stealthy Attributes of APT Lazarus | Group-IB Blog | | |
| 2024-11-14T15:00:12 | Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack | | |
| 2024-11-21T10:55:47.000Z | DPRK IT Workers | A Network of Active Front Companies and Their Links to China | SentinelOne | | |
| 2024-11-22T11:00:00+00:00 (published_time) | Sapphire Sleet cryptocurrency theft (fake venture capitalist / recruiter schemes) | | Sapphire Sleet |
| 22/11/2024 | Aerospace and defense companies | >1 | Ruby Sleet |
| 25/11/2024 | Multiple organizations in China and Russia | CN RU | Threat actors from North Korea |
| 2024-12-02 | 위협 행위자 김수키의 이메일 피싱 캠페인 분석 | | Kimsuky; 김수키 |
| 2026-04 | Drift Protocol | Australia | UNC4736 |
| 2025-02 | Bybit | United Arab Emirates | Lazarus |
| 2025-01 | Phemex | Singapore | |
| 2025-02 | Operation “DEEP#DRIVE” | | Kimsuky, Velvet Chollima |
| 2025-01 | Operation “99” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-01 | Operation “Phantom Circuit” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-01 | Operation “Marstech Mayhem” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| In recent months (as of 2025-01-23) | IT workers extorting employers with stolen data and code | United States | North Korean IT workers |
| From around December 2025 through July 2026 | WaterPlum / Contagious Interview fake job-interview malware campaign (30,000 PCs, 100+ countries) | | WaterPlum ("Contagious Interview") |
| As of 2025 | Kimsuky "quishing" (malicious QR code) spearphishing against think tanks, academia, governments | | Kimsuky |
| 2025-01-23 | Andariel 공격 그룹이 활용하는 RID Hijacking 공격 기법 | | Andariel |
| 2025-01-28T00:00:00.000Z | Suspected DPRK Campaign Persists with SparkRAT Activity (in "Unmasking SparkRAT") | South Korea (server hosted in Seoul) | suspected DPRK |
| 2025-02-03T20:13:32.000Z | macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed | SentinelOne | | |
| 2025-02-04 | RDP Wrapper를 활용한 Kimsuky 그룹의 지속적인 위협 | | Kimsuky |
| 2025-02-03 | K 메신저로 유포된 'APT37' 그룹의 악성 HWP 사례 분석 | | APT37 |
| 05/02/2025 | Multiple Organizations | >1 | Lazarus Group |
| 11/02/2025 | Individuals that work in international affairs organizations, NGOs, government agencies, and media companies across North America, South America, Europe, and East Asia. | >1 | Kimsuky (aka Emerald Sleet or Velvet Chollima |
| February 13, 2025 | PurpleBravo (Contagious Interview) targeting of cryptocurrency entities (October-November 2024) | United Arab Emirates | PurpleBravo (formerly TAG-120) |
| 19/02/2025 | It Workers at Western Companies | >1 | North Korea's cyber-espionage campaign, "Contagious Interview." |
| 2025/02/20 | DeceptiveDevelopment targets freelance developers | | |
| 2026-09 | Bitget | Seychelles | Trader Traitor |
| 2026-08 | arrayref | | Sapphire Sleet |
| 2026-06 | Mastra | United States | Sapphire Sleet |
| 2026-04 | KelpDAO / LayerZero | India | Trader Traitor |
| 2026-03 | Axios | | Bluenoroff |
| 2026-03 | Bitrefill | Sweden | Bluenoroff |
| 24 Feb 2026 | North Korean Lazarus Group Now Working With Medusa Ransomware | | |
| 2026-01-22 | KONNI Adopts AI to Generate PowerShell Backdoors | | |
| 2026-07-01T17:53:56.469Z | PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems | | |
| 2026-08-11 | Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack | | |
| January 20 2026 | Threat Actors Expand Abuse of Microsoft Visual Studio Code | | threat actor operating on behalf of North Korea (DPRK) |
| January 21, 2026 | PurpleBravo weaponized coding tests and likely victims across the IT software supply chain (August 2024 to September 2025) | Belgium, Bulgaria, Costa Rica, India, Italy, the Netherlands, Pakistan, Romania, the United Arab Emirates (UAE), and Vietnam | PurpleBravo |
| 2026-02-09 (datePublished) | UNC1069 intrusion at a FinTech entity using compromised Telegram account, fake Zoom meeting and deepfake | | UNC1069 |
| 2026-02-11T16:00:00.000Z | graphalgo fake recruiter campaign targets crypto developers with RAT | | Lazarus Group |
| 12/02/2026 | Multiple organizations | Global | Threat actors from China (APT31, Temp.HEX), Iran (APT42), North Korea (UNC2970), and Russia |
| 2026-02-26 | APT37 Ruby Jumper: Air-Gap Attack via Removable Media | | |
| 2026-02-27T14:18:40.511Z | StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer | | |
| Cloud Threat Horizons Report H1 2026 (no exact date on page) | UNC4899 Kubernetes compromise and cryptocurrency theft from a cryptocurrency organization (2025) | | UNC4899 |
| 2026-03-15 | Konni 그룹의 스피어피싱·카카오톡 연계 위협 캠페인 분석 | | KONNI; Konni; 코니 |
| 17/03/2026 | Developers and professionals involved in blockchain-related projects. | Global | WaterPlum (part of the Contagious Interview Campaign from North Korea) |
| 25/03/2026 | Undisclosed organizations in the retail industry | Unknown | North Korean APT groups (overlapping with "Contagious Interview") |
| 2026-04-02T13:00:00.000Z | DPRK-Related Campaigns with LNK and GitHub C2 | FortiGuard Labs | | |
| 03/04/2026 | Node.js ecosystem maintainers (Socket CEO, Platformatic CTO, Dotenv creator, Node.js Security WG, and others) | Global | UNC1069 (North Korean state-linked) |
| 2026-04-07T21:36:45.870Z | North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads | | |
| 2026-04-12 | APT37의 프리텍스팅 기반 표적 침투: 페이스북 정찰과 소프트웨어 변조 공격 분석 | | APT37 |
| 16/04/2026 | Professionals and organizations in the cryptocurrency, venture capital, and blockchain sectors | Global | Sapphire Sleet (a.k.a. BlueNoroff, APT38, Stardust Chollima) |
| 21/04/2026 | High-level fintech and cryptocurrency executives and developers using macOS | Global | Lazarus Group (aliases: Hidden Cobra, APT38, Zinc, Labyrinth Chollima) |
| 2026-04-21 | Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories | | |
| 22/04/2026 | Web developers
26,584 cryptocurrency wallets on 2,726 infected systems | Global | Famous Chollima (a.k.a. HexagonalRodent) |
| 2026-04-27T11:59:23+00:00 | BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector | North America | BlueNoroff (subgroup of Lazarus Group) |
| 29/04/2026 | Software developers (npm ecosystem)
Organizations hiring remote developers | Global | Famous Chollima (linked to Contagious Interview) |
| 2026-05-05 | Korean-speaking users via sqgame[.]net (China-based game platform) | KR,CN | APT37 (a.k.a. ScarCruft, Ricochet Chollima) |
| 2026-05-27 | South Korean military and corporate entities | KR | Kimsuky (aka Velvet Chollima, North Korea) |
| June 08, 2026 | UNK_DeadDrop developer-recruitment phishing against close to 100 organizations (April-May 2026) | | UNK_DeadDrop (very likely North Korea-aligned) |
| 2026-06-11 | Financial services firms and cryptocurrency exchanges (APAC/Oceania, 78+ organizations) | Multiple | North Korea-linked / China-linked threat groups (multiple) |
| 2026-06-14 | MS 사칭 피싱과 Dead-drop C2 기반 APT37 NarwhalRAT 분석 | | APT37 |
| 2026-06-23T21:59:42.000Z | macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox | SentinelOne | | |
| 2026-06-24 | Software developers using npm (html-to-gutenberg, fetch-page-assets) and 16 hijacked Go packages | Multiple | Unknown (linked to North Korea "Fake Font" / Contagious Interview) |
| 2026-06-30 | JavaScript build ecosystem / Developers" | Global | Lazarus Group |
| 2026-07-20 | South Korean groupware software vendors and their SaaS customers | KR | Kimsuky (APT43) |
| 2026-07-21 | Cryptocurrency and Web3 professionals | Multiple | Famous Chollima |
| 2026-07-30 | 72 South Korean organizations across financial, healthcare, and other sectors (via 15 compromised watering-hole websites) | KR | Unattributed state-sponsored group (possible Lazarus links, unconfirmed) |
| 2026-08-10T16:02:45.000Z | Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (NullReceiver / Contagious Interview) | | DPRK-linked Contagious Interview campaign; Lazarus APT group |
| 2026-08-10 | Government and critical-infrastructure organizations worldwide | US, KR | Gunra (Golden Community) |
| 01/09/2026 | Western companies in healthcare, IT, sales, and marketing | AU, MULTIPLE | FAMOUS CHOLLIMA |
| 04/09/2026 | Two South Korean organizations (automotive and media sectors) | KR | APT37 (North Korea; medium confidence) |
| 20/09/2026 | npm package @dforge-core/dforge-mcp (versions 0.2.20/0.2.21); 65+ public GitHub repositories, 73 infected files, 22 accounts | UNKNOWN | Unknown (possible unconfirmed link to PolinRider/North Korea) |
| 2026-09-18T17:00:16.000Z | Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne | | |
| 01/01/1970 | Targets in the US | US | Hidden Cobra (AKA Lazarus Group) |
| 01/01/1970 | North Korea | KR | China |
| 01/01/1970 | US and western financial institutions | >1 | Hidden Cobra |
| 01/01/1970 | Targets in Iran, Russia, China, and North Korea | >1 | CIA |
| 01/01/1970 | Unnamed organization in the cryptocurrency vertical | N/A | HIDDEN COBRA AKA The Lazarus Group AKA APT38 |