| 2019-04-25T18:28:33.000Z | Lazarus APT Targets Mac Users with Poisoned Word Document - SentinelLabs | | |
| 2020-02-26T02:46:14.000Z | DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity - SentinelLabs | | |
| August 2023 | CSIS entry 201 | | |
| 2023-06 | JumpCloud | United States | UNC4899 |
| 2023-05-04T13:55:19.000Z | Kimsuky Evolves Reconnaissance Capabilities in New Global Campaign | SentinelOne | | |
| 2023-05-23T11:23:42.000Z | Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit | SentinelOne | | |
| June 1, 2023 | Impersonation of South Korean think tank researchers | South Korea | Kimsuky (Thallium, APT43, Velvet Chollima, Black Banshee) |
| 2023-01-04T13:28:11.000Z | LABScon Replay | InkySquid: The Missing Arsenal | SentinelOne | | |
| 2024-01-22T13:55:47.000Z | ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals | SentinelOne | | |
| 2024-11-07T10:55:47.000Z | BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence | SentinelOne | | |
| 2024-11-21T10:55:47.000Z | DPRK IT Workers | A Network of Active Front Companies and Their Links to China | SentinelOne | | |
| 2024-05-08T10:00:18.000Z | LABScon23 Replay | macOS Components Used in North Korean Crypto-Heists | SentinelOne | | |
| 2025-09-04T09:55:04.000Z | Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms | SentinelOne | | |
| 2025-07-02T09:55:37.000Z | macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware | SentinelOne | | |
| 2026-06-23T21:59:42.000Z | macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox | SentinelOne | | |
| 2026-09-18T17:00:16.000Z | Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne | | |