| 2025-12-04 | Vong scheme: Doe likely a North Korean national | | John Doe aka William James |
| 2025-06-30 | Uncovering DPRK Remote Workers: Detecting Hidden Threats Through Internet Telemetry | | DPRK operatives; North Korean IT contractors |
| 2026-03-16 | Potential DPRK remote worker investigation for a corporate client (in "Corporate Threat Intelligence and Digital Investigations Explained") | China; North Korea (laptop locations) | DPRK remote worker |
| 2026-04-22 | Unmasking DPRK Cyber Threat Actors: Fake IT Worker Infrastructure (luckyguys[.]site) | | DPRK-linked fake IT workers |
| 2026-04-29 | North Korea IT workers and Lazarus fake job campaigns against the defense industrial base (in "Nation-State Threats Targeting the Defense Industrial Base") | US; UK (infrastructure nodes) | Lazarus; North Korea |