DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

UN Panel of Experts S/2024/215 (165)

Date (as written)IncidentCountryActors
2017-12YoubitKorea, Republic ofBluenoroff
2017-12NiceHashSloveniaBluenoroff
2017-09CoinisKorea, Republic ofBluenoroff
2017-06Bithumb#2Korea, Republic ofBluenoroff
2017-04YapizonKorea, Republic ofBluenoroff
2017-02Bithumb#1Korea, Republic ofBluenoroff
2018-10Trade.ioSwitzerlandBluenoroff
2018-09IndodaxIndonesiaBluenoroff
2018-09ZaifJapanBluenoroff
2018-07BancorSwitzerlandBluenoroff
2018-06Bithumb#3Korea, Republic ofBluenoroff
2018-06CoinrailKorea, Republic ofBluenoroff
2018-05TaylorEstoniaBluenoroff
2018-04Gate.ioCayman IslandsBluenoroff
2018-04CoinSecureIndiaBluenoroff
2018-03CypheriumUnited StatesBluenoroff
2018-08-??Unidentified Company
September 2019U.S.-based company hack (September 2019)United StatesThe North Korea-associated hacker
2019-07CoinTigerSingapore
2019-03Bithumb#4Korea, Republic of
2019-03BiKiSingapore
2019-03CoinBeneJapan
2019-03DragonExSingaporeLazarus
2019-01CryptopiaNew ZealandBluenoroff
28 May 2019UpBit attacked. No losses reported.ROKSuspected DPRK (annex title)
2020-11Nexus MutualUnited KingdomBluenoroff
2020-09KuCoinSingaporeLazarus
2020-09EterbaseSlovakiaLazarus
18 Feb 2021Lazarus: Three North Koreans Charged for Financially Motivated Attacks
2020Kimsuky nuclear and COVID-19 medical espionageKimsuky
2021-11bZxUnited StatesBluenoroff
2021-10MGNRUnited StatesBluenoroff
2021-07Bondly FinanceUnited StatesBluenoroff
2021-06Fetch.aiUnited Kingdom
2021-05FinNexusVirgin Islands, BritishBluenoroff
2021-04EasyFiIndiaBluenoroff
01.10.2021North Korean state-sponsored hacker group Lazarus gained access to the corporate network of an aerospace company in the Netherlands in October 2021NetherlandsLazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
likely between late 2021 and May 2022Compromise of the email server and internal network of NPO MashinostroyeniaRussian FederationScarCruft and the Lazarus Group (separate intrusions)
2023-033CXUnited StatesUNC4736
2022-08Nomad BridgeUnited States
2022-06Harmony BridgeUnited States
2022-03Axie InfinityViet Nam
2022-03DeFiance CapitalSingapore
2022-01Qubit FinanceUnited Kingdom
01.01.2022North Korean state-sponsored hacking group 'Lazarus' gained access to network of unspecified Spanish aerospace company beginning in 2022SpainLazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
between May and November 2022“No Pineapple” campaign (Zimbra exploitation; 100 GB stolen)Lazarus Group
2022-12-27T08:00:26BlueNoroff introduces new methods bypassing MoTW
2022Backdoor and data theft (satellite component blueprints) at Sputnix OOORussian FederationDemocratic People’s Republic of Korea hackers
2023-12Orbit BridgeKorea, Republic of
2023-11CyberLinkTaiwanDiamond Sleet
2023-11HECO BridgeSingaporeLazarus
2023-11HTXSeychellesLazarus
2023-11UnoRe DAOEstonia
2023-11PoloniexUnited StatesLazarus
2023-10Fantom FoundationCayman Islands
2023-09CoinExUnited StatesLazarus
2023-09Stake.comAustraliaLazarus
2023-08SteadefiVirgin Islands, BritishLazarus
2023-07AlphapoSaint Vincent and the GrenadinesLazarus
2023-07CoinsPaidEstoniaLazarus
2023-06JumpCloudUnited StatesUNC4899
2023-06Atomic WalletEstoniaLazarus
2023-04Merlin DEXUnited Kingdom
2023-04Terraport FinanceUnited Kingdom, 🇰🇷 Korea, Republic of
October 2023CSIS entry 165
2023-12-11T13:50:59.000ZOperation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang
01.10.2023North Korean state-sponsored hacking group Diamond Sleet compromised vulnerable TeamCity servers since early October 2023Not availableAndariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
2023-08-24T12:04:22.000ZLazarus Group's infrastructure reuse leads to discovery of new malware
2023-05Kimsuky Group Using Meterpreter to Attack Web ServersKimsuky, Velvet Chollima
2023-07-18T14:43:24+00:00Security alert: social engineering campaign targets technology industry employeesJade Sleet; TraderTraitor
2023-10Operation “Dream Magic”Lazarus Group, Hidden Cobra, Labyrinth Chollima
2023-10Elastic catches DPRK passing out KANDYKORNLazarus Group, Hidden Cobra, Labyrinth Chollima
2023-07Operation “STARK#MULE”Reaper, APT 37, Ricochet Chollima, ScarCruft
2023-06-11A Large Theft / Investment Platform
2023-09-28Unidentified Company
16 August 2023[unidentified company]unidentifiedSuspected DPRK (annex title)
2023-10-18 (press release date)Justice Department Announces Court-Authorized Action to Disrupt Illicit Revenue Generation Efforts of Democratic People’s Republic of Korea Information Technology Workers
(published 23 November 2023)DPRK state-linked software supply chain attacks using zero-day vulnerabilities (NCSC-NIS joint advisory)DPRK state-linked cyber actors
June 1, 2023Impersonation of South Korean think tank researchersSouth KoreaKimsuky (Thallium, APT43, Velvet Chollima, Black Banshee)
07/08/2023NPO MashinostroyeniyaRUScarCruft
6 November 2023“BlueNoroff strikes again with new macOS malware,” Jamf Threat LabsBlueNoroff
2023-03-28 (datePublished)APT43 espionage and cryptocurrency theft to fund operationsSouth Korea, Japan, Europe, and the United StatesAPT43 (Kimsuky)
2023-04-12T08:00:00Following the Lazarus group by tracking DeathNote campaign
20/04/2023People working in software or DeFi platforms>1Lazarus Group AKA Labyrinth Collima, Covellite, UNC4034, Zinc, Nickel Academy)
06/06/2023Financial institutions and venture capital firms in Japan, Vietnam, and the United StatesJP US VNTAG-71 (APT38)
08/11/2023IT Job Seekers>1BlueNoroff (AKA APT38, Sapphire Sleet, CageyChameleon, and CryptoCore)
21/11/2023Multiple western organizations>1Threat actors from North Korea
2023-11-21북 해킹조직의 정부기관·언론사 등 사칭 전자우편 주의
05/12/2023South Korean companies connected to the defense industryKRAndariel
2023-02-03정상 문서로 위장한 악성코드(kimsuky)Kimsuky
2023-02-15Anti-Forensic Techniques Used By Lazarus GroupAPT38; Kimsuky; Lazarus
2023-03-08대북 관련 질문지를 위장한 CHM 악성코드 (Kimsuky)Kimsuky
2023-03-20사례비 지급 내용으로 위장한 OneNote 악성코드 (Kimsuky)Kimsuky
2023-03-23Kimsuky 그룹, 약력 양식 파일로 위장한 악성코드 유포 (GitHub)APT37; Kimsuky; ScarCruft
2023-03-24Kimsuky 그룹, ADS를 활용하여 악성코드 은폐Kimsuky
2023-07-31코인 및 투자 관련 내용으로 위장한 악성코드 유포 중Kimsuky
2023-11-01[Kimsuky] Operation Covert StalkerKimsuky
2023-11-30HWP 문서 내부에 악성 OLE 삽입 공격 FlowerPower APT 캠페인 Github C2 사용APT37; Kimsuky
2023-10-30FastViewer Variant Merged with FastSpy and disguised as a Legitimate Mobile ApplicationKimsuky
2023-09-05T05:00:00.000ZVMConnect PyPI campaign (in "Threat research roundup: Lessons learned from recent PyPI and npm supply chain attacks")Lazarus; Labyrinth Chollima
December 12, 2023How one country is impacting supply chains (North Korean supply chain attacks; Contagious Interview)North Korean state-sponsored groups; Lazarus group
February 2023Attack on a defence company in PolandPolandLazarus Group
2023-10-17APT trends report Q3 2023 (DPRK-related paragraph 1)
2023Malicious packages on the npm package managerLazarus Group
2023Andariel exfiltration of pharmaceutical research and development and weapons development dataAndariel
first half of 2023Attacks targeting China (government, financial, media, education sectors)ChinaLazarus Group; Kimsuky
2023Activity in the Russian Federation (“still [has] access to a number of Russian systems”)Russian FederationLazarus Group
2023IT workers building or exploiting vulnerabilities in platforms and smart contracts; suspected smaller cryptocurrency heists; fake-identity employmentDPRK IT workers
14 September 2023“Konni APT exploits WinRAR vulnerability (CVE-2023-38831) targeting the cryptocurrency industry,” Chuangyu 404 Advanced Threat Intelligence TeamScarCruft (APT 37)
9 October 2023“Detailed Malware Analysis Report: Putty disguised as malware (Lazarus APT),” HauriLazarus Group
4 November 2023“Crypto-Themed npm Packages Found Delivering Stealthy Malware,” Phylum Research Team
2023-12-05T10:00:34BlueNoroff: new Trojan attacking macOS users
6 December 2023“Analysis of North Korean Hackers’ Targeted Phishing Scams on Telegram,” SlowMistLazarus Group
2023-12-08T18:54:17.000ZAnalysis of Suspected Lazarus (APT-Q-1) Attack Sample Targeting npm Package Supply Chain
JanuaryMalware Disguised as a Manuscript Solicitation Letter (Targeting Security-Related WorkersKimsuky
Januaryta444-apt-startup-aimed-at-your-fundsTA444 (Overlaps with BlueNoroff)
January疑似 APT-C-26 （ Lazarus）组织通过 加密货币钱包推广信息 进行攻击活动分析Lazarus Group
Aprilbluenoroff-apt-targets-macos-rustbucket-malware/BlueNoroff
MayKimsuky Group's Phishing Attacks Targeting North Korea-Related PersonnelKimsuky
MayLazarus Group Targeting Windows IIS Web ServersLazarus Group
Maykimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/Kimsuky
Maykimsuky-evolves-reconnaissance-capabilities-in-new-global-campaign/Kimsuky
Mayhttps://www.police.go.kr/viewer/skin/doc.html?fn=d6c2795c-3930-44ab-970d-d2d7a14f9571.hwpx&rs=/viewer/202305 (see S/2023/656 Annex 65)DPRK cyber actors (suspected Kimsuky)
JuneAPT-C-26（ Lazarus） 组织使用伪造 VNC 软 件的攻击活动分析Lazarus Group
Julyhttps://www.qianxin.com/threat/reportdetail?report_id=295 https://www.qianxin.com/threat/reportdetail?report_id=292Lazarus/ Kimsuky
Julyhttps://www.mandiant.com/resources/blog/north-korea-supply-chainDPRK cyberthreat actor
Julyhttps://asec.ahnlab.com/ko/55646/Kimsuky
AugustCyber attack confirmed to have been carried out by North Korea’s ‘Kimsuky’ targeting ROK-US joint military exercisesKimsuky
SeptemberActive North Korean campaign targeting security researchersDPRK cyber actors
Septemberthreat_inteligence_report_k onniapt.pdfScarCruft
Septemberhttp://english.chosun.com/site/data/html_dir/2023/09/07/2023090701108.htmlDPRK cyber threat actors
Septemberhttps://paper.seebug.org/3033/ScarCruft
September/ Octoberlazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/ Lazarus-campaigns-and-backdoors-in-2022-2023.pdfLazarus Group
September/ Octoberhttps://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/ https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/Lazarus/ Andariel
Octobernorth-korea-cyber-structure-alignment-2023All DPRK malicious cyber groups
Octobersecurity-insider/microsoft-digital-defense-report-2023?rtc=1Lazarus/ Andariel/ BlueNoroff
Octoberhttps://www.hauri.co.kr/security/security.htmlLazarus
October국정원 “北 , 김정은 군함 건조 지시에 국내 조선사 해킹 시도 ” (chosun.com)DPRK cyberthreat actor
Use of generative AI / ChatGPT for phishing and malware developmentKimsuky; Democratic People’s Republic of Korea cyberactors
OctoberAPT trends report Q3 2023 | SecurelistLazarus Group
OctoberA Cascade of Compromise: Kaspersky Exposes Lazarus’ New Campaign Exploiting Legitimate Software | KasperskyLazarus Group
November보도자료 : HOME > 알림 /소식 > 알림 > 보도자료 (police.go.kr)DPRK cyber actors
NovemberMicrosoft: BlueNoroff hackers plan new crypto-theft attacksBlueNoroff
Novemberkonni-campaign-distributed-via-malicious-documentScarCruft
Novemberhttps://rt-solar.ru/events/news/3851/Lazarus Group
Novemberhttps://asec.ahnlab.com/ko/58818/DPRK cyber actors
Novemberhttps://asec.ahnlab.com/en/59073/Andariel
Novemberhttps://asec.ahnlab.com/ko/59130/ https://asec.ahnlab.com/en/59318/Andariel
November수입 신고서를 위장하여 국내 연구 기관을 노리는 KimsukyKimsuky
Decemberhttps://www.koreaherald.com/view.php?ud=20231201000614Lazarus Group
December疑似 Lazarus（ APT-Q-1）涉及 npm 包供应链 的攻击样本分析Lazarus Group
DecemberKimsuky Group Uses AutoIt to Create Malware (RftRAT, Amadey)Kimsuky
Decemberhttps://asec.ahnlab.com/en/60054/Kimsuky
Decemberhttps://mp.weixin.qq.com/s/f5YE12w3x3wad5EO0EB53Q https://blog.phylum.io/crypto-themed-npm-packages-found-delivering-stealthy-malware/Lazarus Group
December북한 시장 물가 분석 문서 등으로 위장된 공격 사례 (genians.co.kr)Kimsuky
Decemberhttps://www.koreatimes.co.kr/www/nation/2023/12/103_364423.htmlAndariel
Malicious Python packages (typosquatting) on an open-source Python repositoryLazarus Group
Fake employers luring software developers to install malware from GitHub through job interviewsDemocratic People’s Republic of Korea actors
Malicious Android apps disguised as e-commerce, Google Authenticator, anti-virus and payment appsKimsuky
Persistent spearphishing of the private email address of a member of the PanelDemocratic People’s Republic of Korea cyberactors, probably Kimsuky
WinRAR vulnerability (CVE-2023-38831) attack on the cryptocurrency industryScarCruft
Kimsuky cryptocurrency mining, cryptojacking and cybercrime operationsKimsuky (APT 43)
Andariel ransomware attacks on three companiesAndariel
Phishing campaigns targeting cryptocurrency industry workers, including blockchain engineersThe Lazarus Group and BlueNoroff
Ransomware distributed in collaboration with a Republic of Korea company; recovery costs from more than 700 victimsRepublic of KoreaLazarus Group actors