| May-Sept 2017 / 23 September 2017 | ROK Police reported attacks on three cryptocurrency exchanges by DPRK actors and detailed that 25 employees | ROK | Suspected DPRK (annex title) |
| 2017-09-17 (datePublished) | Watering hole compromise of a bitcoin news site (2016) | | North Korean operators |
| 2018-02-20 (datePublished) | APT37 (Reaper) operations incl. zero-days and wiper malware | Primarily South Korea – though also Japan, Vietnam and the Middle East | APT37 (Reaper; Scarcruft; Group123) |
| 2018-10-03 (datePublished) | APT38 financial crime against banks worldwide (since at least 2014) | at least 13 countries | APT38 |
| 2022-09-14 (datePublished) | UNC4034 job opportunity phishing via WhatsApp with trojanized PuTTY (AIRDRY.V2) at a media company | | UNC4034 (suspected North Korea nexus) |
| 2022-03-23 (datePublished) | Bureau 325 COVID-19-focused targeting shifting to defectors, defense, governments, media, cryptocurrency services and financial institutions | | Bureau 325 (assessed) |
| 2023-06 | JumpCloud | United States | UNC4899 |
| 2023-03-30T11:37:54+00:00 (published_time) | 3CX Desktop App supply chain compromise (ICONIC) | | UTA0040, later attributed to Lazarus |
| 2023-03-09 (datePublished) | UNC2970 job-recruitment phishing against Western media and technology companies (since June 2022) | U.S.-based; U.S. and European | UNC2970 (suspected UNC577 / Temp.Hermit) |
| 2023-03-28 (datePublished) | APT43 espionage and cryptocurrency theft to fund operations | South Korea, Japan, Europe, and the United States | APT43 (Kimsuky) |
| 2023-10-10 (datePublished) | COVID-19-focused DPRK task force targeting healthcare and research entities | | overlaps with APT43 and TEMP.Hermit; unverified link to Andariel |
| 2023-10-10 (datePublished) | Suspected APT37 GitHub repository with decoy documents (exposed March 2023) | South Korea | APT37 |
| 2023-10-10 (datePublished) | Andariel (UNC614) MAUI ransomware against hospitals | | Andariel (UNC614) |
| 2024-09-17 (datePublished) | UNC2970 trojanized SumatraPDF job lures (MISTPEN via BURNBOOK) against energy and aerospace | U.S. | UNC2970 |
| 2024-07-25 (datePublished) | APT45 targeting of nuclear research facilities and Kudankulam Nuclear Power Plant (2019) | India | APT45 |
| 2024-07-25 (datePublished) | APT45 targeting of a South Korean financial organization (2016) and spear-phishing of a South Asian bank (2021) | South Korean; South Asian | APT45 |
| 2024-07-25 (datePublished) | APT45 targeting of crop science division of a multinational corporation (September 2020) | | APT45 |
| 2024-07-25 (datePublished) | APT45 long-running espionage, financial and possible ransomware operations (since 2009) | | APT45 |
| 2024-09-23 (datePublished) | DPRK IT workers (UNC5267) obtaining remote employment; facilitator case | U.S.; China and Russia, with smaller numbers in Africa and Southeast Asia | UNC5267 (DPRK IT workers) |