| 2021-07-13 | Matryoshka : Variant of ROKRAT, APT37 (Scarcruft) | | APT37; Scarcruft |
| 2021-07-08 | Analysis of Lazarus malware abusing Non-ActiveX Module in South Korea | | Lazarus |
| 2021-01-27 | Analysis of THREATNEEDLE C&C Communication (feat. Google TAG Warning to Researchers) | | Lazarus |
| 2022-10-24 | Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware | | Kimsuky |
| 2023-03-23 | Scarcruft Bolsters Arsenal for targeting individual Android devices | | Scarcruft |
| 2023-10-30 | FastViewer Variant Merged with FastSpy and disguised as a Legitimate Mobile Application | | Kimsuky |
| 2023-05-17 | Detailed Analysis of AlphaSeed, a new version of Kimsuky’s AppleSeed written in Golang | | Kimsuky |
| 2023-03-17 | Kimsuky group appears to be exploiting OneNote like the cybercrime group | | Kimsuky |
| 2024-01 | D2 Innovation | Korea, Republic of | Kimsuky |
| May 2024 | “Operation Code on Toast”: IE zero-day via pop-up “toast ads” against ROK national security officials and DPRK-related NGOs (RokRAT) | Republic of Korea | APT37 |
| 2024-08-22 | Threat Tracking: Analysis of puNK-003’s Lilith RAT ported to AutoIt Script | | puNK-003 |
| 2024-10-02 | [VirusBulletin 2024] Go-ing Arsenal: A Closer Look at Kimsuky’s Go Strategic Advancement | | APT43; Kimsuky |
| 2025-08-07 | ScarCruft’s New Language: Whispering in PubNub, Crafting Backdoor in Rust, Striking with Ransomware | | ChinopuNK; ScarCruft |
| 2026-09-16 | Ransomware Landscape in H1 2026: Statistics and Key Issues | | Andariel; Lazarus; puNK-012 |