| 2017/2018 | Cryptocurrency attacks on South Korean exchanges. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 07/06/2020 | Multiple online stores | >1 | Lazarus Group AKA Hidden Cobra |
| 06/06/2023 | Financial institutions and venture capital firms in Japan, Vietnam, and the United States | JP US VN | TAG-71 (APT38) |
| CTA-NK-2023-0622 (report ID; June 2023) | North Korea's Cyber Strategy: 273 cyberattacks attributed to DPRK state-sponsored actors (July 2009 to May 2023) | South Korea; the US | Kimsuky; Lazarus Group; APT37 |
| 2025-02 | Bybit | United Arab Emirates | Lazarus |
| February 13, 2025 | PurpleBravo (Contagious Interview) targeting of cryptocurrency entities (October-November 2024) | United Arab Emirates | PurpleBravo (formerly TAG-120) |
| February 13, 2025 | North Korea-linked front companies in China spoofing legitimate IT firms (TAG-121) | China; spoofed firms in China, India, Pakistan, Ukraine, and the United States | TAG-121 |
| November 12, 2025 | PurpleDelta (North Korean IT workers) applications to over 1,100 companies (late 2024 to early 2025) | operators likely based in China | PurpleDelta |
| January 21, 2026 | PurpleBravo weaponized coding tests and likely victims across the IT software supply chain (August 2024 to September 2025) | Belgium, Bulgaria, Costa Rica, India, Italy, the Netherlands, Pakistan, Romania, the United Arab Emirates (UAE), and Vietnam | PurpleBravo |
| publication date not shown on page (2026) | Bybit theft attributed by FBI to TraderTraitor (cited in Recorded Future blog) | | TraderTraitor |
| publication date not shown on page | Crypto Country: North Korean cryptocurrency theft since 2017 | South Korean market; globally | North Korean threat actors |
| APT-C-55（Kimsuky）组织依托GitHub+Dropbox分发恶意载荷的攻击活动分析-安全资讯-360官网 | | |
| (no date on page) | Lazarus Hermes ransomware use (in 4 Ransomware Trends to Watch in 2019) | | Lazarus group |
| (no date on page) | North Korean ransomware: WannaCry and Maui (in Ransomware as a State-Sponsored Weapon) | UK | Lazarus Group; North Korea |
| (no date on page) | ClickFix use by PurpleBravo (in ClickFix Campaigns Targeting Windows and macOS) | | North Korean group PurpleBravo |
| (no date on page) | Lazarus React2Shell exploitation to deploy COPPERHEDGE (in H1 2026 Malware Vulnerability Trends) | | Lazarus |
| (no date on page) | APT37 Facebook-based pretexting campaign with tampered PDFelement installer (in H1 2026 Malware Vulnerability Trends) | | APT37 |
| (no date on page) | North Korea IT employment scheme / PurpleDelta (in Synthetic Identities: A Dual Threat to Enterprises) | US | PurpleDelta (North Korea) |