| 2007 | Operation “Flame” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2009-07 | 7.7 DDoS | United States, 🇰🇷 Korea, Republic of | |
| 2011-03 | 3.4 DDoS | Korea, Republic of, 🇺🇸 United States | |
| 2023-05 | North Korea Using Social Engineering to Enable Hacking of Think Tanks, Academia, and Media | | Kimsuky, Velvet Chollima |
| 2012 | Spying on South Korean users. | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2013-06 | 6.25 Cyber Terror | Korea, Republic of | Lazarus |
| 2013-03 | 3.20 Cyber Terror | Korea, Republic of | WHOis Team |
| 01.01.2013 | Operation“Kimsuky” | Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;China;China;China;China | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 2013-05 | South Korean Financial Companies Targeted by Castov | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2014-12 | Sony Pictures Entertainment | United States | Lazarus |
| 2014-12 | Korea Hydro and Nuclear Power | Korea, Republic of | Kimsuky |
| 2016 | Operation “Erebus” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2016-03 | Operation “Daybreak” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2016-08 | Operation “Golden Time” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2016-11 | Operation “Evil New Year” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2017-05 | WannaCry Ransomware | ZZZ, 🇷🇺 Russian Federation, 🇯🇵 Japan, 🇬🇧 United Kingdom, 🇫🇷 France, 🇰🇷 Korea, Republic of, 🇮🇳 India, 🇨🇳 China, 🇩🇪 Germany, 🇪🇸 Spain, 🇮🇩 Indonesia, 🇧🇷 Brazil, 🇺🇸 United States | Lazarus |
| 2017-08 | The Blockbuster Saga Continues | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 01.09.2017 | North Korean Lazarus group conducts Operation Sharpshooter against organziations in global defense and critical infrastructure since September 2017 | United States;United States;United States;United States | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2017 Late | Several financial sector and a casino breaches using KillDisk wiping malware in Latin America and USA. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2017/2018 | Cryptocurrency attacks on South Korean exchanges. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2017-03 | Operation “Are You Happy?” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2017-05 | Operation “FreeMilk” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2017-11 | Operation “North Korean Human Right” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2017-12 | Operation “Fractured Block” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2019-09 | Indian Financial Institute | India | Lazarus |
| December 2018 | CSIS entry 779 | | |
| 2018-04 | Operation “GhostSecret” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| March 2018 | CSIS entry 867 | | |
| 2018-04 | The first artefacts we found relating to MATA were used around April 2018. After that, the actor behind this advanced malware framework used it aggressively to infiltrate corporate entities around the world. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-03 | Operation “Baby Coin” | | Kimsuky, Velvet Chollima |
| 2018-10 | Operation “Mystery Baby” | | Kimsuky, Velvet Chollima |
| 2/1/2019 | Babyshark - US | US / N Korea | |
| 2018-01 | F-Secure’s investigation revealed that a system administrator from the target organization received a phishing document via their personal LinkedIn account. The document masqueraded as a legitimate job advert for a role in a blockchain technology company that matched the employee’s skills. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-08 | Operation “AppleJeus” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-07 | Operation “CryptoCore” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-11 | More Attacks on Cryptocurrency Businesses | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2018-01 | Operation “Evil New Year 2018” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2018-03 | Operation “Battle Cruiser” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2018-04 | Operation “Star Cruiser” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2018-05 | Operation “Onezero” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2018-08 | Operation “Rocket Man” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2018-11 | Operation “Korean Sword” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2019-10 | Kudankulam Nuclear Power Plant | India | Lazarus |
| 21/08/2019 | North Korea? | >1 | ? |
| 2019-03-27 | 라자루스(Lazarus) 그룹, 이스라엘 군수업체 대상 APT 역습 | | Lazarus; 라자루스 |
| 01.09.2019 | Operation In(ter)ception | Europe (region);Middle East (region) | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.07.2019 | Fractured Statue | United States | TA406/Konni Group/Opal Sleet fka OSMIUM < Kimsuky |
| October 2019 | AppleJeus Version 2: JMT Trading (trojanized cryptocurrency application) | | HIDDEN COBRA |
| 2019-01 | Operation “Kabar Cobra” | | Kimsuky, Velvet Chollima |
| 2019-04 | Operation “Stealth Power” | | Kimsuky, Velvet Chollima |
| 2019-04 | Operation “Smoke Screen” | | Kimsuky, Velvet Chollima |
| 2019-07 | Operation “Red Salt” | | Kimsuky, Velvet Chollima |
| August 2019 | Targeting of retired South Korean diplomats, government and military officials | | Kimsuky |
| 2019-05 | Hackers associated with the APT Lazarus/HIDDEN COBRA group were found to be breaking into online stores of large US retailers and planting payment skimmers as early as May 2019. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2019-09 | Lazarus Group’s MATA Framework Leveraged to Deploy TFlower Ransomware | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2019-01 | Operation “Holiday Wiper” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2019-03 | Operation “Golden Bird” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2019-03 | Operation “High Expert” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2019-04 | Operation “Black Banner” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2019-09 | Operation “Dragon messenger” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2020/11/16 | Lazarus supply-chain attack in South Korea | | |
| 2020-07 | VHD Ransomware | ZZZ | Lazarus |
| 2021-05-31T17:00:00+00:00 | Kimsuky APT continues to target South Korean government using AppleSeed backdoor | South Korea | Kimsuky (Thallium, Black Banshee, Velvet Chollima) |
| 01.01.2020 | ThreatNeedle: Defense Industries | Unknown | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-01-25T23:59:00+00:00 (datePublished) | Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects) | | government-backed entity based in North Korea |
| 23/12/20 | Undisclosed pharmaceutical company | N/A | Lazarus Group |
| mid-March 2020 | “Security alert”-themed spear-phishing of 28 individuals including 11 officials from six Security Council members | | Kimsuky advanced persistent threat group |
| August 13, 2020 | Operation ‘Dream Job’ Widespread North Korean Espionage Campaign | | |
| 2020-03 | According to a tweet shared by South Korean cyber-security firm IssueMakersLab, a group of North Korean hackers also hid malware inside documents detailing South Korea's response to the COVID-19 epidemic. | | Kimsuky, Velvet Chollima |
| 2021-01-03 | 탈륨 조직, 사설 주식 투자 메신저 악용해 소프트웨어 공급망 공격 수행 | | 블루 에스티메이트; 탈륨 |
| Jul 29, 2020 | Operation (North Star) North Star: A Job Offer That's Too Good to be True? | | Hidden Cobra |
| 2020-03 | Operation “Spy Cloud” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2021-06 | Seoul National University Hospital | Korea, Republic of | |
| 2021-06 | Korea Atomic Energy Research Institute | Korea, Republic of | |
| January 2022 | CSIS entry 396 | | |
| 01.10.2021 | North Korean state-sponsored hacker group Lazarus gained access to the corporate network of an aerospace company in the Netherlands in October 2021 | Netherlands | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-03 | ScarCruft surveilling North Korean defectors and human rights activists | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2021-08-19T17:00:00+00:00 | New variant of Konni malware used in campaign targeting Russia | Russia | APT37 (Konni, potentially linked) |
| 2021-11-10T22:11:00.000Z | North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets | | |
| 2021-03 | Lazarus Attack Activities Targeting Japan (VSingle/ValeforBeta) | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2021-06 | APT actor Lazarus attacks defense industry, develops supply chain attack capabilities | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 10/11/2021 | Security Researchers worldwide | >1 | Lazarus Group AKA HIDDEN COBRA |
| 2021-04 | North Korean APT InkySquid Infects Victims Using Browser Exploits | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2024-04 | Defense Contractors | Korea, Republic of | |
| 2023-03 | 3CX | United States | UNC4736 |
| 2022-06 | Harmony Bridge | United States | |
| 2022-03 | Axie Infinity | Viet Nam | |
| August 2023 | CSIS entry 201 | | |
| April 2022 | CSIS entry 353 | | |
| 2022-02 | On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 01.01.2022 | North Korean state-sponsored hacking group 'Lazarus' gained access to network of unspecified Spanish aerospace company beginning in 2022 | Spain | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.06.2022 | North Korean state-sponsored hacking group UNC2970 targeted US and European media and technology companies since at least June 2022 | Europe (region);Europe (region);United States;United States | TEMP.Hermit/ UNC577 < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Lab 110) |
| 01.05.2022 | North Korean state-sponsored hacking group Lazarus gained access to the network of a financial organisation in May 2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| between May and November 2022 | “No Pineapple” campaign (Zimbra exploitation; 100 GB stolen) | | Lazarus Group |
| 19 May 2022 | Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped) - ASEC BLOG (ahnlab.com) | | Lazarus Group |
| 2022-09-29T16:00:00+00:00 (published_time) | ZINC weaponizing open-source software (PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, muPDF/Subliminal Recording) via LinkedIn/WhatsApp | US, UK, India, and Russia | ZINC (now Diamond Sleet) |
| 01.02.2022 | Between February and July 2022, the North Korean group Lazarus targeted organizations, including energy service providers worldwide | Global (region);Canada;United States;Japan | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2022-04 | Operation “Covert Stalker” | | Kimsuky, Velvet Chollima |
| 2022-01 | North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-02 | Operation “LolZarus” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022 Early | Tracing State-Aligned Activity Targeting Journalists, Media | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-06 | ₿uyer ₿eware: Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-08 | deBridge Finance crypto platform targeted by Lazarus hackers | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-08 | Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-09 | SlowMist: Investigation of North Korean APT’s Large-Scale Phishing Attack on NFT Users | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022 Late | North Korean hackers linked to defense sector supply-chain attack | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-07 | Operation “STIFF#BIZON” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022-09 | Meeting the “Ministrer” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022-10 | Internet Explorer 0-day exploited by North Korean actor APT37 | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022 Late | Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack | | Operation Earth Kitsune |
| 2023-11 | CyberLink | Taiwan | Diamond Sleet |
| 2023-09 | CoinEx | United States | Lazarus |
| 2023-09 | Stake.com | Australia | Lazarus |
| 2023-07 | Alphapo | Saint Vincent and the Grenadines | Lazarus |
| 2023-07 | CoinsPaid | Estonia | Lazarus |
| 2023-06 | JumpCloud | United States | UNC4899 |
| 2023-06 | Atomic Wallet | Estonia | Lazarus |
| August 2023 | CSIS entry 190 | | |
| 2023-11 | Kimsuky Targets South Korean Research Institutes with Fake Import Declaration | | Kimsuky, Velvet Chollima |
| 01.10.2023 | North Korean state-sponsored hacking group Diamond Sleet compromised vulnerable TeamCity servers since early October 2023 | Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-08-24T12:04:22.000Z | Lazarus Group's infrastructure reuse leads to discovery of new malware | | |
| 2023-07 | Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 21/06/2023 | Multiple organizations | N/A | APT37 (AKA StarCruft, Reaper, or RedEyes) |
| Not available | Lazarus Group targeted Windows IIS Web Servers in Global Campaign | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-03 | North Korean APT group ‘Kimsuky’ targeting experts with new spearphishing campaign | | Kimsuky, Velvet Chollima |
| 2023-05 | Kimsuky Group Using Meterpreter to Attack Web Servers | | Kimsuky, Velvet Chollima |
| 2023-05 | Kimsuky Group’s Phishing Attacks Targetting North Korea-Related Personnel | | Kimsuky, Velvet Chollima |
| 2023-11 | SmallTiger Malware Used in Attacks Against South Korean Businesses (Kimsuky and Andariel) | | Kimsuky, Velvet Chollima |
| 2023-06 | Lazarus Threat Group Exploiting Vulnerability of Korean Finance Security Solution | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-07-18T14:43:24+00:00 | Security alert: social engineering campaign targets technology industry employees | | Jade Sleet; TraderTraitor |
| 27/10/2023 | Undisclosed software vendor | N/A | Lazarus (aka Diamond Sleet and ZINC) |
| 2023-10 | Operation “Dream Magic” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-10 | Elastic catches DPRK passing out KANDYKORN | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2023-04 | ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK) | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2023-07 | Operation “STARK#MULE” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2023-12 | ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2024-10 | Radiant Capital | Hong Kong | Citrine Sleet |
| 2024-05 | DMM | Japan | |
| 01.01.2024 | North Korean state-sponsored hacking group APT37 delivered a previously undocumented backdoor and remote access trojan called VeilShell to targets in Cambodia in 2024 | Cambodia | APT37 |
| 01.06.2024 | The North Korean state-sponsored hacking group UNC2970 gained access to a multinational energy company in June 2024 | Not available | Unknown |
| 19.08.2024 | North Korean Hacker Group Citrine Sleet Exploits Chromium Zero-Day Vulnerability on 19 August 2024 | United States | Unknown |
| 01.01.2024 | North Korean hackers target South Korean defense contractor on 8 August 2024 | Korea, Republic of | Unknown |
| 2024 | Operation “DEEP#GOSU” | | Kimsuky, Velvet Chollima |
| 2024-01 | North Korean hackers exploit VPN update flaw to install malware | | Kimsuky, Velvet Chollima |
| 2024-06-27 | Kimsuky Deploys TRANSLATEXT Chrome Extension |ThreatLabz | | |
| 2024-03 | Attack Activities by Kimsuky Targeting Japanese Organizations | | Kimsuky, Velvet Chollima |
| 2024-05 | North Korean Hackers Exploit Facebook Messenger in Targeted Malware Campaign | | Kimsuky, Velvet Chollima |
| 2024-07 | APT Group Kimsuky Targets University Researchers | | Kimsuky, Velvet Chollima |
| 2024-09 | North Korea Hackers Linked to Breach of German Missile Manufacturer | | Kimsuky, Velvet Chollima |
| 2024-09 | North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks | | Kimsuky, Velvet Chollima |
| 2024-02 | Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2024-05 | The Crypto Game of Lazarus APT: Investors vs. Zero-days | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2024-09-10T05:00:00.000Z | Fake recruiter coding tests target devs with malicious Python packages (VMConnect) | | Lazarus Group |
| 2024-11 | Operation “SyncHole” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2024-09 | Kimsuky-linked hackers use similar tactics to attack Russia and South Korea, researchers say | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2024-08-29T19:31:00+00:00 | North Korea Still Attacking Developers via npm | | groups aligned with North Korean objectives |
| 2024-04 | Operation “DEV#POPPER” | | [Unnamed groups: North Korea] |
| 2025-05 | BitoPro | Taiwan | Lazarus |
| 2025-02 | Bybit | United Arab Emirates | Lazarus |
| 2025-02 | Operation “DEEP#DRIVE” | | Kimsuky, Velvet Chollima |
| 2025-02 | Phishing Email Attacks by the Larva-24005 Group Targeting Japan | | Kimsuky, Velvet Chollima |
| 2025-01 | Operation “99” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-01 | Operation “Phantom Circuit” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-01 | Operation “Marstech Mayhem” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-03 | Operation “ToyBox Story” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |