| October 2019 - March 2022 | ‘DeathNote’ campaign (also referred to as ‘Operation Dream Job’) | | Lazarus Group |
| 2021-06 | Seoul National University Hospital | Korea, Republic of | |
| between May and November 2022 | “No Pineapple” campaign (Zimbra exploitation; 100 GB stolen) | | Lazarus Group |
| late December 2022 | TA444 credential-harvesting phishing (“SendGrid URL”) | multiple Member States | TA444 (“overlaps with BlueNoroff”) |
| 2023-06 | JumpCloud | United States | UNC4899 |
| 2023-06 | Atomic Wallet | Estonia | Lazarus |
| Not available | Lazarus Group targeted Windows IIS Web Servers in Global Campaign | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| over the last couple of years (as of 20 March 2023) | Kimsuky spear phishing against Korean and German entities | South Korea; Germany | KIMSUKY (Thallium, Velvet Chollima) |
| February 09, 2023 | DPRK ransomware attacks on Healthcare and Public Health and other critical infrastructure | | DPRK cyber actors |
| 2023-05 | Kimsuky Group Using Meterpreter to Attack Web Servers | | Kimsuky, Velvet Chollima |
| 2023-05 | Kimsuky Group’s Phishing Attacks Targetting North Korea-Related Personnel | | Kimsuky, Velvet Chollima |
| 2023-05-04T13:55:19.000Z | Kimsuky Evolves Reconnaissance Capabilities in New Global Campaign | SentinelOne | | |
| 2023-03-30T11:37:54+00:00 (published_time) | 3CX Desktop App supply chain compromise (ICONIC) | | UTA0040, later attributed to Lazarus |
| 2023-05-23T11:23:42.000Z | Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit | SentinelOne | | |
| June 1, 2023 | Impersonation of South Korean think tank researchers | South Korea | Kimsuky (Thallium, APT43, Velvet Chollima, Black Banshee) |
| 2023-03-30 | 금융보안인증 프로그램(이니세이프) 취약점 악용 해킹 [기사: 국정원, 보안인증 프로그램 취약점 활용한 북 해킹 포착] | | 북한 |
| 2023-02-03 | 정상 문서로 위장한 악성코드(kimsuky) | | Kimsuky |
| 2023-02-15 | Anti-Forensic Techniques Used By Lazarus Group | | APT38; Kimsuky; Lazarus |
| 2023-03-08 | 대북 관련 질문지를 위장한 CHM 악성코드 (Kimsuky) | | Kimsuky |
| 2023-03-20 | 사례비 지급 내용으로 위장한 OneNote 악성코드 (Kimsuky) | | Kimsuky |
| 2023-03-23 | Kimsuky 그룹, 약력 양식 파일로 위장한 악성코드 유포 (GitHub) | | APT37; Kimsuky; ScarCruft |
| 2023-03-24 | Kimsuky 그룹, ADS를 활용하여 악성코드 은폐 | | Kimsuky |
| 2023-06-16 | 다양한 주제를 이용하여 CHM 악성코드를 유포 중인 Kimsuky | | Kimsuky |
| April 2023; June 2023 (updated version) | RustBucket macOS malware | | BlueNoroff |
| Disguised malicious attachments (Word macro, CHM, OneNote) leaking victim data | | Kimsuky |
| Fake webmail website of a DPRK-related research institute used for credential phishing | | Kimsuky |
| Malware hidden with Alternate Data Stream | | Kimsuky |
| ReconShark-related spear-phishing targeting emails of various United Nations personnel | | Kimsuky |
| DPRK IT worker stole tokens from a cryptocurrency platform via vulnerabilities he wrote into its smart contracts | | a DPRK IT worker |
| DPRK IT worker developing smart contracts for cross-chain bridges while posing as a Western Hemisphere citizen | | a DPRK IT worker |