| 2021-10-25T16:00:17+00:00 (blog summarizing MDDR 2021) | THALLIUM large-scale spear-phishing against government sector (MDDR 2021) | | THALLIUM |
| 2022-07 | H0lyGh0st Ransomware | United States | DEV-0530 |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | CERIUM and ZINC targeting defense and aerospace companies (fake recruiter LinkedIn profiles) | around the globe | CERIUM; ZINC |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | CERIUM probing South Korean VPNs and targeting the South Korean military | South Korean | CERIUM |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | COPERNICIUM targeting cryptocurrency-related companies, including in China and Hong Kong | around the world; China, both on the mainland and in Hong Kong | COPERNICIUM |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | DEV-0215 targeting media organizations that follow North Korean news and Korean-speaking Christian communities | | DEV-0215 |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | OSMIUM interest in international aid organizations | | OSMIUM |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | North Korean targeting of Russian think tanks, academics, and diplomatic officials | Russian | North Korean threat actors |
| 2023-03-30T11:37:54+00:00 (published_time) | 3CX Desktop App supply chain compromise (ICONIC) | | UTA0040, later attributed to Lazarus |
| Microsoft Digital Defense Report 2023 | Diamond Sleet compromising nuclear energy organizations (spring 2023) and maritime entities (fall 2022) | globally | Diamond Sleet |
| Microsoft Digital Defense Report 2023 | Ruby Sleet use of a stolen IT security solutions provider certificate (early 2023) | | Ruby Sleet |
| Microsoft Digital Defense Report 2023 | Harmony Horizon Bridge heist (June 2022) attributed to Jade Sleet | | Jade Sleet |
| Microsoft Digital Defense Report 2023 | Emerald Sleet spear-phishing of Korean Peninsula experts | around the world | Emerald Sleet |
| Microsoft Digital Defense Report 2023 | Sapphire Sleet fake LinkedIn investor profiles targeting blockchain-related targets | | Sapphire Sleet |
| Microsoft Digital Defense Report 2023 | Ruby Sleet fake LinkedIn profiles targeting a defense company and cybersecurity company in Israel | Israel | Ruby Sleet |
| Microsoft Digital Defense Report 2023 | Ruby Sleet, Diamond Sleet, and Sapphire Sleet targeting maritime and shipbuilding sector (November 2022 to January 2023) | | Ruby Sleet; Diamond Sleet; Sapphire Sleet |
| Microsoft Digital Defense Report 2023 | Ruby Sleet and Diamond Sleet compromise of two arms manufacturing companies in Germany and Israel (November 2022 to January 2023) | Germany and Israel | Ruby Sleet; Diamond Sleet |
| Microsoft Digital Defense Report 2023 | Diamond Sleet compromise of defense firms in Brazil, Czechia, Finland, Italy, Norway, and Poland (since January 2023) | Brazil, Czechia, Finland, Italy, Norway, and Poland | Diamond Sleet |
| Microsoft Digital Defense Report 2023 | Diamond Sleet trojanized VNC compromise of a Russian nuclear energy organization (May 2023) | Russian | Diamond Sleet |
| Microsoft Digital Defense Report 2023 | Ruby Sleet, Onyx Sleet and Opal Sleet targeting Russian aerospace institute, university, and diplomatic entities (March 2023) | Russian | Ruby Sleet; Onyx Sleet; Opal Sleet (likely) |
| 2024-05 | FakePenny Ransomware | ZZZ | Moonstone Sleet |
| Microsoft Digital Defense Report 2024 | Jade Sleet, Sapphire Sleet, and Citrine Sleet targeting cryptocurrency organizations (since 2023) | | Jade Sleet; Sapphire Sleet; Citrine Sleet |
| Microsoft Digital Defense Report 2024 | North Korean targeting by region and sector (United States first, United Kingdom second; IT sector most targeted) | The United States; the United Kingdom | North Korean threat actors |
| Microsoft Digital Defense Report 2025 | North Korean remote IT workers embedded at organizations worldwide | around the world; US-based companies | North Korean IT workers (Jasper Sleet) |
| Microsoft Digital Defense Report 2025 | North Korean actor participating as a ransomware-as-a-service (RaaS) affiliate for the first time | | a North Korean actor (not named in this passage) |
| Microsoft Digital Defense Report 2025 | North Korean targeting focus: IT sector, banking/blockchain, defense, manufacturing; South Korea in APAC | South Korea | North Korean threat actors |