| 2022-03-01T00:00:00.000Z | Targeted APT Activity: BABYSHARK Is Out for Blood | | DPRK state-sponsored threat actor |
| 2023-03-30T11:37:54+00:00 (published_time) | 3CX Desktop App supply chain compromise (ICONIC) | | UTA0040, later attributed to Lazarus |
| 2025-06-18T05:00:00.000Z | Inside the BlueNoroff Web3 macOS Intrusion Analysis (Feeling Blue(Noroff)) | | TA444 aka BlueNoroff, Sapphire Sleet, COPERNICIUM, STARDUST CHOLLIMA, CageyChameleon |
| 2025-06-30T05:00:00.000Z | Fake IT worker deepfake scams linked to North Korea, incl. Kraken targeted (in Tradecraft Tuesday recap "AI: Friend or Faux") | | threat actors linked to North Korea |
| 2025-09-18T05:00:00.000Z | North Korean IT worker schemes (in "How Malicious Hackers Try to Infiltrate Your IT Team") | China; Russia (where operatives often work from); US (identities) | North Korean IT workers |
| 2026-03 | Axios | | Bluenoroff |
| 2026-03-17T14:00:00.000Z | ITDR incident linked to North Korean cybercrime syndicates (in "Huntress Expands Into Proactive Security Posture Management") | | North Korean cybercrime syndicates (overlapping activity) |
| 2026-05-20T13:00:00.000Z | Moonstone Sleet as a Qilin ransomware affiliate (in "Inside the RaaS Ecosystem") | | Moonstone Sleet |
| 2026-05-21T07:00:00.000Z | Workstation in The Gentlemen ransomware intrusion identified as Lazarus infrastructure (in "The Gentleman Ransomware | Defense Evasion TTPs Uncovered") | | Lazarus (per Red Asgard) |