| 2021-05-31T17:00:00+00:00 | Kimsuky APT continues to target South Korean government using AppleSeed backdoor | South Korea | Kimsuky (Thallium, Black Banshee, Velvet Chollima) |
| 2020-05-11 | Lazarus’ MacOS Dacls RAT Shows Multi-Platform Ability | | |
| 2021-08-19T17:00:00+00:00 | New variant of Konni malware used in campaign targeting Russia | Russia | APT37 (Konni, potentially linked) |
| 2021-01-05T17:00:00+00:00 | Retrohunting APT37: VBA self decode technique to inject RokRat | | APT37 |
| 2021-04-19T22:00:00+00:00 | Lazarus APT conceals malicious code within BMP image to drop its RAT | South Korea | Lazarus APT |
| 2022-01 | North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-07-09T17:00:00+00:00 | North Korean APT targets US healthcare sector with Maui ransomware | United States | State-sponsored North Korean threat actors |
| 2022-01-25T17:00:00+00:00 | KONNI evolves into stealthier RAT | Russia; South Korea | Kimsuky umbrella (KONNI) |
| February 09, 2023 | DPRK ransomware attacks on Healthcare and Public Health and other critical infrastructure | | DPRK cyber actors |
| 2023-03-30T11:37:54+00:00 (published_time) | 3CX Desktop App supply chain compromise (ICONIC) | | UTA0040, later attributed to Lazarus |
| 2024-05 | FakePenny Ransomware | ZZZ | Moonstone Sleet |
| 2024-06-25T15:14:00+00:00 | GrimResource MSC attack used by Kimsuky | Japan (signs of deployment) | Kimsuky APT group |
| 2024-09-24T14:42:41+00:00 | North Korean IT workers—or how not to solve the IT staff shortage | | North Korea (DPRK) IT workers |