UN Panel of Experts S/2023/171 (46)

Date (as written)	Incident	Country	Actors
since March 2020	VHD, BEAF, PXJ, ZZZZ and ChiChi ransomware		BlueNoroff (also known as APT38) (code similarities)
since July 2020	Voice phishing hacking applications sold by Song Rim (continued)	China; Republic of Korea	Song Rim (Munitions Industry Department-linked IT worker)
2022-07	Maui Ransomware	United States, 🇯🇵 Japan	Andariel
2022-07	H0lyGh0st Ransomware	United States	DEV-0530
2022-06	Harmony Bridge	United States
2022-03	Axie Infinity	Viet Nam
2022-11-15T10:00:28	DTrack activity targeting Europe and Latin America
2022-09-29T16:00:00+00:00 (published_time)	ZINC weaponizing open-source software (PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, muPDF/Subliminal Recording) via LinkedIn/WhatsApp	US, UK, India, and Russia	ZINC (now Diamond Sleet)
01.02.2022	Between February and July 2022, the North Korean group Lazarus targeted organizations, including energy service providers worldwide	Global (region);Canada;United States;Japan	Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
2022-09	SlowMist: Investigation of North Korean APT’s Large-Scale Phishing Attack on NFT Users		Lazarus Group, Hidden Cobra, Labyrinth Chollima
2022-12-27T08:00:26	BlueNoroff introduces new methods bypassing MoTW
27 Apr 2022	Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets
2022-01-13T09:00:23	The BlueNoroff cryptocurrency hunt is still on
2022-12-01T15:41:19+00:00 (published_time)	Lazarus Group AppleJeus campaign via fake BloxHolder cryptocurrency trading website and malicious Office documents		Lazarus Group
31/03/2022	Cryptocurrency users and investors.	>1	Lazarus Group
2022-12-26	기자·국회의원실등 사칭 전자우편 발송사건, 북 해킹조직 소행으로 확인
2022-07-19 (press release date)	Justice Department Seizes and Forfeits Approximately $500,000 from North Korean Ransomware Actors and their Conspirators
08/02/2022	Organizations in South Korea	KR	Kimsuky AKA TA406
2022-10-24	Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware		Kimsuky
2022-03-23	PDF 문서로 위장하여 유포되는 VBS 스크립트 (Kimsuky)		Kimsuky
2022-03-29	울진 산불 피해 기부 영수증으로 위장한 워드 문서 APT 공격 (Kimsuky)		Kimsuky
2022-04-18	INITECH 프로세스에 인젝션돼 동작하는 라자루스 공격 그룹의 신종 악성코드		Lazarus; 라자루스
2022-05-18	다양한 주제의 보도자료를 사칭한 Kimsuky 공격시도		Kimsuky
2022-06-30	발주서, 품의서를 위장한 AppleSeed 유포		Kimsuky
2022-07-21	특정 군부대 유지보수 업체 대상으로 AppleSeed 유포		Kimsuky
2022-07-26	공격자 메일에 회신한 경우에 외부 링크로 제공되는 워드문서 (Kimsuky)		Kimsuky
2022-09-22	라자루스 그룹의 BYOVD를 활용한 루트킷 악성코드 분석 보고서		라자루스
2022-10-06	라자루스 그룹 DLL Side-Loading 기법 이용 (mi.dll)		라자루스
2022-10-27	원자력 발전소 관련 기업 대상으로 AppleSeed 유포		Kimsuky
June 2022	Targeting of a governmental entity in Ukraine	Ukraine	Lazarus
October	Attacks targeting digital asset firms		Lazarus Group
December	AppleJeus Attacks		Lazarus Group
January	Distribution of KONNI RAT		Kimsuky
February	APT attacks using DPRK related documents		Kimsuky
March	APT attacks using Word Files about Cryptocurrency		Kimsuky
April	Targeting Chemical Sector (Operation Dream Job)		Lazarus Group
May	Exploiting Log4Shell Vulnerability (NukeSped)		Lazarus Group
	“SHARPEXT” malicious browser extension campaign		Kimsuky (“Sharptongue”)
August	AppleSeed on Nuclear Energy related Industries		Kimsuky
	MacOS spear-phishing with fake Coinbase job advertisements targeting fintech developers		Lazarus Group
September	Amazon-themed campaigns (Dell)		Lazarus Group
September	Three RATs attack		Lazarus Group
	Windows rootkit exploiting a Dell firmware driver (CVE-2021-21551), BLINDINGCAN backdoor; target included an aerospace company employee		Lazarus Group
	DLL side-loading attacks and vulnerable driver modules		Lazarus Group
November	Targeting Ukraine Entities		Lazarus Group
	Malicious Word files with DPRK-related materials sent from fake personae		Kimsuky