| 2021-01-25T23:59:00+00:00 (datePublished) | Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects) | | government-backed entity based in North Korea |
| 2022-07 | H0lyGh0st Ransomware | United States | DEV-0530 |
| 2022-09-29T16:00:00+00:00 (published_time) | ZINC weaponizing open-source software (PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, muPDF/Subliminal Recording) via LinkedIn/WhatsApp | US, UK, India, and Russia | ZINC (now Diamond Sleet) |
| 2022-12-06T17:00:00+00:00 (published_time) | DEV-0139 targeted attacks against the cryptocurrency industry via Telegram chat groups | | DEV-0139 (now Citrine Sleet) |
| 2022-11-10T17:00:00+00:00 (published_time) | ZINC weaponizing open-source software (CyberWarCon 2022 talk) | 34 countries | ZINC (now Diamond Sleet) |
| 2023-11 | CyberLink | Taiwan | Diamond Sleet |
| 01.10.2023 | North Korean state-sponsored hacking group Diamond Sleet compromised vulnerable TeamCity servers since early October 2023 | Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-10-18T16:30:00+00:00 (published_time) | Diamond Sleet software supply chain compromise of a German software provider (August 2023) | German | Diamond Sleet (ZINC) |
| 2024-05 | FakePenny Ransomware | ZZZ | Moonstone Sleet |
| 19.08.2024 | North Korean Hacker Group Citrine Sleet Exploits Chromium Zero-Day Vulnerability on 19 August 2024 | United States | Unknown |
| 01.05.2024 | The North Korean state-aligned hacking group Moonstone Sleet compromised an aircraft parts manufacturer in May 2024 | Not available | Unknown |
| 2024-11-22T11:00:00+00:00 (published_time) | Sapphire Sleet cryptocurrency theft (fake venture capitalist / recruiter schemes) | | Sapphire Sleet |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet malicious tank game DeTankWar | | Moonstone Sleet |
| 2024-02-14T12:00:00+00:00 (published_time) | Emerald Sleet spear-phishing of experts on North Korea and use of LLMs | | Emerald Sleet (THALLIUM); overlaps Kimsuky, Velvet Chollima |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet trojanized PuTTY via LinkedIn, Telegram and freelancing platforms (August 2023) | | Moonstone Sleet (formerly Storm-1789) |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet malicious npm packages / fake skills assessments | | Moonstone Sleet |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet fake companies StarGlow Ventures and C.C. Waterfall email campaigns | | Moonstone Sleet |
| 2024-07-25T15:57:18+00:00 (published_time) | Onyx Sleet intelligence-gathering campaigns; May 2024 targeting of South Korean educational institutions, construction and manufacturing organizations | India, South Korea, and the United States; South Korean | Onyx Sleet |
| 2024-11-22T11:00:00+00:00 (published_time) | Ruby Sleet supply chain attack on a Korean construction company (VeraPort) and aerospace/defense compromises | Korean | Ruby Sleet |
| 2024-11-22T11:00:00+00:00 (published_time) | North Korean IT workers (repository found October 2024) | operating out of North Korea, Russia, and China | North Korean IT workers |
| 2025-06-30T19:17:49+00:00 (published_time) | Jasper Sleet North Korean remote IT workers using AI; 3,000 Microsoft consumer accounts suspended | United States (US) companies; globally | Jasper Sleet (formerly Storm-0287); also Storm-1877 and Moonstone Sleet |
| 2026-03 | Axios | | Bluenoroff |
| 2026-03-06T17:00:00+00:00 (published_time) | Jasper Sleet and Coral Sleet (formerly Storm-1877) operationalizing AI in remote IT worker activity | | Jasper Sleet; Coral Sleet (formerly Storm-1877) |
| 2026-04-16T15:00:00+00:00 (published_time) | Sapphire Sleet macOS intrusion campaign (fake software update / Teams-themed lure) | | Sapphire Sleet |
| 2026-04-21T16:03:09+00:00 (published_time) | Jasper Sleet abuse of Workday Recruiting Web Service / career sites | | Jasper Sleet |