| 2017-12 | Unknown POS | Korea, Republic of | Lazarus |
| 2017/2018 | Cryptocurrency attacks on South Korean exchanges. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| November 18, 2021 | TA406 credential theft campaigns (2021) against foreign policy experts, journalists and NGOs | | TA406 (part of Kimsuky / Thallium / Konni) |
| 2022 Early | Tracing State-Aligned Activity Targeting Journalists, Media | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| January 25, 2023 | TA444 cryptocurrency theft (2021-2022) | | TA444 (APT38, Bluenoroff, BlackAlicanto, Stardust Chollima, COPERNICIUM) |
| January 25, 2023 | TA444 OneDrive credential harvesting campaign (early December 2022) | United States and Canada | TA444 |
| May 24, 2023 | TA444 phishing of a US digital banking institution (December 2022, CageyChameleon) | United States | TA444 |
| April 16, 2024 | TA427 benign-conversation phishing of foreign policy experts with DMARC abuse (since 2023) | US; Republic of Korea (ROK or South Korea) | TA427 (Emerald Sleet, APT43, THALLIUM, Kimsuky) |
| April 17, 2025 | TA427 ClickFix campaign against think tanks; Japanese diplomat impersonation (January-February 2025) | Washington, DC; South Korea (infrastructure) | TA427 (Kimsuky / Emerald Sleet) |
| May 13, 2025 | TA406 phishing and malware against Ukrainian government entities (February 2025) | Ukraine; Russia (historical) | TA406 (Opal Sleet, Konni) |
| June 08, 2026 | UNK_DeadDrop developer-recruitment phishing against close to 100 organizations (April-May 2026) | | UNK_DeadDrop (very likely North Korea-aligned) |