| 2016 and 2017; October 2017 campaign | Spearphishing operation targeting the UNSC 1718 Committee’s Panel of Experts | | cyberactors of the DPRK, probably belonging to the Kimsuky Group |
| August 2017 | “File sharing”-themed spearphishing campaigns against the UN including the Security Council | | Kimsuky |
| 2018-08 | Operation “AppleJeus” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2019-10 | Kudankulam Nuclear Power Plant | India | Lazarus |
| October 2019 | AppleJeus Version 2: JMT Trading (trojanized cryptocurrency application) | | HIDDEN COBRA |
| 2019-12-11T17:00:24.000Z | 5 Things to Know About SentinelLabs’ Finding Link Between Crimeware and APT Lazarus | SentinelOne | | |
| August 2019 | Spearphishing targeted at five permanent missions of UN Security Council member countries (ANSSI report) | China; France; Belgium; Peru; South Africa (permanent missions) | Kimsuky and Group123 (technical links per ANSSI) |
| January 2020 | At least three Panel experts targeted | | cyberactors of the DPRK |
| Attacks against Korea Hydro and Nuclear Power | Republic of Korea | Kimsuky Group (also known as Velvet Chollima) |
| Spearphishing of 38 email addresses of foreign government representatives to the UN | | DPRK cyber actor associated with the Kimsuky cyber threat group |