| 2020-06-23T05:00:00.000Z | Hidden Cobra - from a shed skin to the viper’s nest | RL Blog | | |
| 2022-12-01T06:00:00.000Z | ZetaNile: Open source software trojans from North Korea | RL Blog | | |
| 2022-08-09T05:00:00.000Z | GwisinLocker ransomware targets South Korean industrial and pharma firms | South Korea | Gwisin group (speculated North Korea based) |
| 01.10.2023 | North Korean state-sponsored hacking group Diamond Sleet compromised vulnerable TeamCity servers since early October 2023 | Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| over the last couple of years (as of 20 March 2023) | Kimsuky spear phishing against Korean and German entities | South Korea; Germany | KIMSUKY (Thallium, Velvet Chollima) |
| 01.01.2023 | APT37 uses M2RAT backdoor for intelligence collection purposes on unspecified individuals since 2023 | Not available | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 2023-03-30T11:37:54+00:00 (published_time) | 3CX Desktop App supply chain compromise (ICONIC) | | UTA0040, later attributed to Lazarus |
| June 1, 2023 | Impersonation of South Korean think tank researchers | South Korea | Kimsuky (Thallium, APT43, Velvet Chollima, Black Banshee) |
| 07/08/2023 | NPO Mashinostroyeniya | RU | ScarCruft |
| January 13, 2023 | Laundering of Harmony proceeds via RAILGUN | | North Korean cyber actors |
| 2023-07-27T05:00:00.000Z | More malicious npm packages found in wake of JumpCloud supply chain hack | | North Korea; Lazarus Group |
| 03/08/2023 | IT Professionals | >1 | Lazarus Group |
| 2023-09-05T05:00:00.000Z | VMConnect PyPI campaign (in "Threat research roundup: Lessons learned from recent PyPI and npm supply chain attacks") | | Lazarus; Labyrinth Chollima |
| 2023-03-09T06:00:00.000Z | The Week in Security: Lazarus attacks same South Korean entity twice, use of hard-coded secrets is up | RL Blog | | |
| 2023-05-25T05:00:00.000Z | The Week in Security: Lazarus targets Microsoft servers in espionage campaign, the future of PyPI | RL Blog | | |
| 2023-07-27T05:00:00.000Z | The Week in Security: North Korean APT targets developers, this Barbie is a cybercriminal | RL Blog | | |
| 2023-03-30T05:00:00.000Z | The Week in Security: Twitter gets subpoena for source code leak, 3CX supply chain attack surfaces | RL Blog | | |
| 2023-04-13T05:00:00.000Z | The Week in Security: 3CX attackers identified as North Korean, CISA pushes Secure by Design | RL Blog | | |
| 2024-09-10T05:00:00.000Z | Fake recruiter coding tests target devs with malicious Python packages (VMConnect) | | Lazarus Group |
| 2024-01-16T06:00:00.000Z | PyPI campaign mimicking open-source Python tools, attributed to Lazarus offshoot (in "SSCS attacks: A (partial) history") | | offshoot of the Lazarus threat group |
| 2024-01-16T06:00:00.000Z | Thallium abuse of stock investment platform installer (in "SSCS attacks: A (partial) history") | | Thallium |
| 2024-02-20T06:00:00.000Z | Lazarus DLL sideloading via IDA Pro library (mentioned in "Attackers leverage PyPI to sideload malicious DLLs") | | Lazarus Group |
| 2024-03-12T05:00:00.000Z | DPRK cryptocurrency theft total (mentioned in BIPClip post) | | nation-state actors affiliated with the Democratic Republic of North Korea (DPRK) |
| 2024-06-10T05:00:00.000Z | 3CX compromise (mentioned in "How to assess and manage commercial software risk") | | Lazarus |
| 2024-07-31T05:00:00.000Z | 3CX attack (mentioned in "Are you prepared for modern supply chain threats?") | | North Korean attackers |
| 2024-10-09T05:00:00.000Z | TeamCity CVE-2023-42793 exploitation by North Korean groups (in "5 commercial software attacks") | | multiple North Korean groups |
| 2025-07-03T05:00:00.000Z | 3CX’s Software Supply Chain Compromise: Lessons Learned | RL Blog | | |
| 2025-09-09T15:00:00.000Z | Contagious Interview / Ferret macOS malware (in "Ransomware 2025: Infostealers on the March") | | North Korea |
| 2026-03 | Axios | | Bluenoroff |
| 2026-02-11T16:00:00.000Z | graphalgo fake recruiter campaign targets crypto developers with RAT | | Lazarus Group |
| 29/04/2026 | Software developers (npm ecosystem)
Organizations hiring remote developers | Global | Famous Chollima (linked to Contagious Interview) |
| 2026-03-24T15:00:00.000Z | Graphalgo campaign (mentioned in "Malicious npm packages use fake install logs to load RAT") | | North Korea-backed hackers |
| 2026-04-09T15:00:00.000Z | Drift compromise and axios compromise (mentioned in "Graphalgo fake recruiter malware campaign respawned") | | North Korean state-sponsored threat actors |
| 2026-04-21T15:00:00.000Z | Kimsuky QR-code spearphishing (FBI flash alert, mentioned in "QR Code Phishing Evolves") | | Kimsuky |
| 2026-06-18T16:00:00.000Z | Claude Opus inserted malicious package into crypto trading app (mentioned in Gartner post) | | North Korea-linked hackers |
| 2026-04-09T15:00:00.000Z | Graphalgo fake recruiter malware campaign respawned | | North Korean state-sponsored threat actors |