| 2024-10 | Play Ransomware | | Andariel |
| 2024-02-06T00:00:00.000Z | APT37 / ScarCruft profile (in "Beyond Headlines & Borders: An Overview of Advanced Threats") | South Korea; Japan; Russia; China; the Middle East | APT37; Ricochet Chollima; RubySleet; InkySquid; ScarCruft |
| 2024-02-28T00:00:00.000Z | Phishing by Appointment: Suspected North Korean Hackers Target Blockchain Community Via Telegram | | Lazarus Group (similar tactics) |
| 2024-03-05T00:00:00.000Z | Open Directory Exposes Phishing Campaign Targeting Google & Naver Credentials | | likely North Korean threat actor; Kimsuky (APT43, Black Banshee, Thallium) overlaps |
| 2024-06-25T00:00:00.000Z | XenoRAT linked to North Korean group (in "Good Game, Gone Bad: Xeno RAT Spread Via .gg Domains and GitHub") | | North Korean hacking group; Kimsuky |
| 2024-10-29T00:00:00.000Z | Suspected DPRK Phishing Campaign Targets Naver; Separate Apple Domain Spoofing Cluster Identified | South Korea | suspected North Korean-linked; Kimsuky-like |
| 2024-12-10T00:00:00.000Z | “Million OK!!!!” and the Naver Facade: Tracking Recent Suspected Kimsuky Infrastructure | South Korea | Kimsuky |
| 2024-11-19T00:00:00.000Z | UAT-5394 customized XenoRAT (mentioned in "XenoRAT Adopts Excel XLL Files and ConfuserEx") | | UAT-5394 (North Korean-linked actor) |
| 2025-01-28T00:00:00.000Z | Suspected DPRK Campaign Persists with SparkRAT Activity (in "Unmasking SparkRAT") | South Korea (server hosted in Seoul) | suspected DPRK |
| 2025-01-14T00:00:00.000Z | ‘JustJoin’ Landing Page Linked to Suspected DPRK Activity Resurfaces | | TA444/BlueNoroff |
| 2025-12-17T00:00:00.000Z | Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns (with Acronis TRU) | | Lazarus; Kimsuky; Lazarus DeceptiveDevelopment cluster |
| 2026-03 | Axios | | Bluenoroff |