| since at least 2012 | Konni espionage against Russian government officials and Russian foreign policy targets | Russian Federation | Konni (also known as TA406) |
| 2013-03 | 3.20 Cyber Terror | Korea, Republic of | WHOis Team |
| 2014-12 | Sony Pictures Entertainment | United States | Lazarus |
| 2014 | Japan case 1: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| 2016-02 | Bangladesh Central Bank | Bangladesh | Bluenoroff |
| 2017-05 | WannaCry Ransomware | ZZZ, 🇷🇺 Russian Federation, 🇯🇵 Japan, 🇬🇧 United Kingdom, 🇫🇷 France, 🇰🇷 Korea, Republic of, 🇮🇳 India, 🇨🇳 China, 🇩🇪 Germany, 🇪🇸 Spain, 🇮🇩 Indonesia, 🇧🇷 Brazil, 🇺🇸 United States | Lazarus |
| 2017 | Theft of BTC from a German victim | Germany | a DPRK cyber actor |
| 2018-08 | Operation “AppleJeus” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| since about 2019 | TA408 custom malware campaigns against aerospace, defense, engineering and pharmaceutical sectors and U.S. and ROK military targets | | TA408 (also known as Cerium) |
| mid-2019 to mid-2024 | SANS FAB/Sangsin IT delegation earnings via U.S. online payment service providers | Laos | SANS FAB / Sangsin IT delegation (lead likely Pak Chol-yong) |
| October 2020 to October 2023 | Christina Marie Chapman laptop farm scheme (more than 300 U.S. companies) | United States | overseas DPRK IT workers with facilitator Christina Marie Chapman |
| early 2020s | AppleJeus malware campaign (fake cryptocurrency trading platform) | | Citrine Sleet |
| 2020 | Japan case 2: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| 2022-07 | Maui Ransomware | United States, 🇯🇵 Japan | Andariel |
| 2021-04 | EasyFi | India | Bluenoroff |
| between May 2021 and March 2023 | Six ransomware incidents affecting victims in the United States and the ROK | United States; Republic of Korea | Rim Jong Hyok (Andariel) |
| October 2021 | Chonsurim IT worker Choe Song Won employed by a U.S. DeFi company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| since at least 2021 | Fraudulent identity documents for DPRK IT workers (The Solutions Tree; Syeda Aliya Batool Zaidi) | Pakistan | facilitators for DPRK IT workers |
| 2022-03 | Axie Infinity | Viet Nam | |
| 2022-12-06T17:00:00+00:00 (published_time) | DEV-0139 targeted attacks against the cryptocurrency industry via Telegram chat groups | | DEV-0139 (now Citrine Sleet) |
| since at least December 2022 (identified November 2023) | Contagious Interview campaign (BeaverTail, InvisibleFerret) | | DPRK cyber actors |
| August 2022 | Choe Song Won employed by a second U.S. DeFi company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| July to December 2022 | Chonsurim IT workers employed by a U.S. NFT start-up (one as senior leader) | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| August 2022 to July 2023 | Chonsurim IT worker (Ukrainian identity) employed by a European manufacturing company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| 2023-03-30T11:37:54+00:00 (published_time) | 3CX Desktop App supply chain compromise (ICONIC) | | UTA0040, later attributed to Lazarus |
| identified November 2023 | Wagemole campaign (fake identities for remote IT jobs) | | North Korean cyber actors |
| 2023 | Maverick hack | | DPRK |
| June 2023 | Atomic Wallet, Coinspaid, and Alphapo thefts (laundered via Huione Pay) | | DPRK cyber actors |
| October and November 2023 | KMCTC IT workers’ fraudulent employment with a Chinese regional hospital network | China | Korea Mangyongdae Computer Technology Corporation (KMCTC) IT workers |
| September 2023 | Chonsurim IT workers working for a cryptocurrency-based online betting platform | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| October 2023 | Chonsurim IT workers developing smart contracts for a cryptocurrency staking company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| March and April 2023 | Cryptocurrency investment scam by Laos-based IT worker Choe Kum Song | | Choe Kum Song (Sangsin / SANS FAB) |
| May 2023 | Han Kwang Hyok seeking use of a U.S. facilitator’s freelance platform account | United States | Han Kwang Hyok (Sangsin / SANS FAB) |
| 2023 and 2024 | Watering hole attacks via ROK authentication software and infiltration of IT asset management servers | Republic of Korea | Temp.Hermit |
| since at least June of 2023 | IT worker team deploying BEAVERTAIL and INVISIBLE FERRET malware | | an IT worker team |
| 2024-10 | Play Ransomware | | Andariel |
| 2024-10 | Tapioca DAO | United States | Lazarus |
| 2024-10 | Radiant Capital | Hong Kong | Citrine Sleet |
| 2024-09 | Truflation | United States | |
| 2024-09 | BingX | Singapore | Lazarus |
| 2024-09 | DeltaPrime | Virgin Islands, British | Lazarus |
| 2024-09 | Indodax#2 | Indonesia | Lazarus |
| 2024-08 | Nexera | Netherlands | Lazarus |
| 2024-07 | WazirX | India | Lazarus |
| 2024-06 | CoinStats | Armenia | |
| 2024-06 | UwU Lend | | Lazarus |
| 2024-06 | Lykke | United Kingdom | |
| 2024-05 | DMM | Japan | |
| 2024-05 | FakePenny Ransomware | ZZZ | Moonstone Sleet |
| 2024-05 | AlexLab | Singapore | Lazarus |
| 2024-04 | Rain.com | Bahamas | APT38 |
| 2024-03 | Munchables | United States | |
| 2024-01 | D2 Innovation | Korea, Republic of | Kimsuky |
| 2024-01 | HectorNetwork | | Lazarus |
| 2024-01 | Concentric.Fi | | Lazarus |
| 2024-01-25 | Wall Street Memes | | |
| 2024-02-09 | PlayDapp | | |
| 2024-03-05 | MurAll | | |
| 2024-03-13 | NFPrompt | | |
| 2024-03-13 | CloudAI | | |
| 2024-05-22 | Exclusible Penthouse | | |
| 2024-05-29 | SpaceCatch | | |
| 2024-07-01 | Kyrrex | | |
| 2024-10-31 | M2 | | |
| 2024-06-09 | Loopring | | |
| 2024-03-26 | PrismaFi | | DPRK (Unidentified) |
| 2024-06-22 | BTCTurk | | TraderTraitor |
| 2024-07-15 | Irys | | CryptoCore |
| 2024-09-26 | Onyx DAO | | DPRK IT workers |
| 2024-11-11 | DeltaPrime | | DPRK IT workers |
| May 2024 | “Operation Code on Toast”: IE zero-day via pop-up “toast ads” against ROK national security officials and DPRK-related NGOs (RokRAT) | Republic of Korea | APT37 |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet malicious tank game DeTankWar | | Moonstone Sleet |
| Throughout 2024 | CryptoCore fake-recruiter campaign contacting over 1,200 cryptocurrency company employees (Slack skill assessment tests) | over a dozen countries | CryptoCore |
| December 2024 | Targeting of James Tang of Fenbushi Capital with fake meeting links | China | DPRK cyber actors |
| 2024 | Cryptocurrency thefts by DPRK IT workers (OnyxDAO, Exclusible Penthouse, BTCTurk) | | DPRK IT workers (according to one private sector partner) |
| January 2024 - September 2025 (reporting period) | Andariel compromises of U.S., ROK, UAE and Israeli IT and defense-related companies | United States; Republic of Korea; UAE; Israel | Andariel |
| 2024 | Data theft and extortion of a U.S. aerospace company | United States | Moonstone Sleet |
| 2024 | Attempted sale of stolen data (NASA, a private U.S. company, UAE government, Spanish healthcare group, Austria-based jet charter) to Stormous ransomware group | United States; UAE; Spain; Austria | DPRK cyber actors (alias linked to Moonstone Sleet’s FakePenny) |
| Throughout 2024 | IT workers using 12 personas via recruitment agencies at European defense subcontractors | Europe | DPRK IT workers (per Mandiant) |
| April to May 2024 | Suspected IT workers seeking jobs requiring U.S. security clearance and at a U.S. government contractor | United States | suspected DPRK IT workers (per Mandiant) |
| late 2024 | One IT worker operating at least 12 personas across Europe and the United States | Europe; United States | a DPRK IT worker |
| since late October 2024 | Extortion by fired IT workers threatening to release former employers’ data | | DPRK IT workers (per Mandiant) |
| 2024 and 2025 | Animation work under false identities (HBO Max, Amazon, Japanese studios) – Dalian Shepherd Boy Animation Studio | China | DPRK IT workers / Dalian Shepherd Boy Animation Studio |
| November and December 2024 | Chonsurim meme coin project intended to defraud investors | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| March 2024 | Chonsurim IT worker employed by a U.S. CRM company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| eight years up to November 2024 | Chonsurim developers employed by a U.S. CRM company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| June to November 2024 | An Chung Yol IT work for U.S. healthcare, content provider and IT training companies | United States | An Chung Yol (Sangsin / SANS FAB) |
| 2024 | U.S.-incorporated front company Guanghe Technology Development LLC used to secure contracts with a Serbian company | United States; Serbia | North Korean IT workers based in China |
| 2024 (arrest) | Ukraine-based facilitator Oleksandr Didenko’s laptop farms supporting at least 300 North Korean IT workers | Ukraine; Poland (arrest); United States (laptop farms) | facilitator for DPRK IT workers |
| 2024 | Japan case 3: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| 2024 | Japan case 4: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| December 2024 | Compromise of Chinese drone manufacturer DJI | China | TraderTraitor |
| May 2024 | Supply chain attack via a DLP software update server against ROK aerospace and shipbuilding defense companies | Republic of Korea | Andariel |
| revealed October 2024 [as printed] | Ransomware-funded data exfiltration from NASA, U.S. Air Force, defense companies, a Chinese energy company, a Taiwan-based defense company and two ROK defense companies | United States; China; Taiwan; Republic of Korea | Rim Jong Hyok and RGB co-conspirators |
| January 2024 - September 2025 (reporting period) | IT workers’ fake job offer compromise of an employee computer at a defense company | | DPRK IT workers |
| February 2024 | Impersonation of Crypto.com with malicious job-description PDFs | | TraderTraitor |
| fall 2024 | Fake videoconferencing troubleshooting spear phishing campaign (AppleScripts) | | CryptoCore |
| 2025-07 | BigONE | Seychelles | Lazarus |
| 2025-06 | Favrr | Gibraltar | Famous Chollima |
| 2025-05 | BitoPro | Taiwan | Lazarus |
| 2025-03 | Zoth | Panama | Lazarus |
| 2025-02 | Bybit | United Arab Emirates | Lazarus |
| 2025-01 | Phemex | Singapore | |
| 2025-02-17 | Ripio | | |
| 2025-02-28 | Fantom Reuse Address | | |
| 2025-09-09 | SwissBord | | DPRK (Unidentified) |
| 2025-01-23 (press release date) | Two North Korean Nationals and Three Facilitators Indicted for Multi-Year Fraudulent Remote Information Technology Worker Scheme that Generated Revenue for the Democratic People’s Republic of Korea | | |
| March 2025 | North Korean IT worker arrested in China for allegedly stealing Chinese military technology information | China | a North Korean IT worker |
| early 2025 | Takeover of the email account of an India-based cryptocurrency gaming company’s CEO; spear phishing of over 250 individuals | India | CryptoCore |
| February 2025 | ClickFake Interview campaign (ClickFix tactic; GolangGhost, FrostyFerret) | | DPRK cyber actors (Lazarus, per Sekoia source title) |
| since at least February 2025 | Qilin ransomware deployments, including a U.S. healthcare provider | United States | Moonstone Sleet (affiliate of Qilin) |
| February 2025 (OpenAI report); 2025 (DeepSeek) | Use of OpenAI tools, ChatGPT and DeepSeek | | CryptoCore; TraderTraitor |
| 2025 | Ryugyong Technology IT workers holding jobs at more than eight companies under false personas | United States; Canada; India; Netherlands; Ireland (employer locations) | DPRK Ryugyong Technology Company (75 Guidance Bureau, MID) |
| mid-2025 | Umnal IT worker Choe Il-kuk (persona “Naoki Murano”) possibly connected to Wagemole and Contagious Interview | Russian Federation (Vladivostok) | Umnal delegation (Chinyong IT) |
| January 2025 | Chonsurim IT worker employed by an international DeFi company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| February 2025 | Chonsurim IT worker developing a payment gateway for a commercial website | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| over a three-year period, as recently as early 2025 | Argentina-based facilitator Antonia Doroganova’s Payoneer accounts for DPRK IT workers | Argentina | facilitator for Amnokgang and Ryugyong IT workers |
| 2025 | Japan case 5: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| March and April 2025 | Registration of fake video conferencing domains for spear phishing (e.g. web001-zoom.us, zoomsdk.us, secure-meeting.cloud) | | CryptoCore |
| Malicious NPM packages for skill assessment tests (e.g. “myetherpackage,” “cryptooooo,” “libcrypt-test”) | | CryptoCore, in addition to other DPRK actor groups |
| IT worker projects in the United Kingdom (e.g. Nodexa token hosting platform) | United Kingdom | DPRK IT workers (per Mandiant) |
| Kyonghung IT: gambling website development, sale of personal data from client databases, SEO for criminal organizations | China (Dandong) | Kyonghung Information Technology Exchange Company (Office 39) |
| Theft of designs and technology (semiconductors, uranium processing, air defense, missiles, SLBM; satellite optical equipment) from the ROK and the UK | Republic of Korea; United Kingdom | North Korea |
| Targeting of a South African satellite company | South Africa | |