DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Jamf Threat Labs (9)

Date (as written)IncidentCountryActors
May 10 2022 (dateCreated 2022-05-10)Mac Protection: New macOS malware 'NukeSped' detected and protected againstLazarus Group
April 21 2023 (dateCreated 2023-04-21)'RustBucket' malware targets macOSBlueNoroff (sub-group of Lazarus Group)
6 November 2023“BlueNoroff strikes again with new macOS malware,” Jamf Threat LabsBlueNoroff
September 27 2023macOS Threat Hunting: Unraveling RustBucket Malware Tactics (JNUC talk)Lazarus APT group; BlueNoroff
September 16 2024Jamf Threat Labs observes targeted attacks amid FBI warningsDPRK
November 25 2025 (dateCreated 2025-11-25)FlexibleFerret: macOS Malware Deploys in Fake Job ScamsDPRK-aligned operators
January 20 2026Threat Actors Expand Abuse of Microsoft Visual Studio Codethreat actor operating on behalf of North Korea (DPRK)
Jamf Threat Labs discovers a new threat targeting macOS
Contagious Interview: Trojanized macOS Installers