| From in or around April 2017 to in or around March 2023 | Yanbian Silverstar / Volasys Silverstar IT worker scheme (at least 130 DPRK IT workers, "IT Warriors") | People's Republic of China; Russian Federation (company bases); U.S. victims | JONG SONG HWA, RI KYONG SIK, KIM RYU SONG, RIM UN CHOL, KIM MU RIM and co-defendants; Yanbian Silverstar; Volasys Silverstar |
| Between in or around December 2018 and in or around July 2022 | U.S. Business #3, an application company located in North Carolina, employed IT worker posing as P.C. | U.S. (North Carolina) | KO CHUNG SOK |
| On or about September 19, 2019 onward; extortion demand and on or about March 9, 2022 leak | U.S. Business #1, a software development company located in Oregon: IT worker hired under M.A. identity; extortion and leak of proprietary information | U.S. (Oregon) | KIM YE WON; SOK KWANG HYOK; HYON CHOL SONG |
| Between on or about January 22, 2020, and on or about July 15, 2022 | U.S. Nonprofit Organization #2 (child mental health, New York) employed IT worker posing as B.T. | U.S. (New York) | CHOE JONG YONG |
| Between on or about October 18, 2021, and on or about April 15, 2022 | U.S. Business #4, an internet streaming technology company located in Iowa, employed IT worker posing as R.W. | U.S. (Iowa) | CHOE JONG YONG |
| On or about September 15, 2021 to October 29, 2021 | U.S. Business #5 (staffing, Washington) and U.S. Business #6 (technology, California): IT worker posing as J.S.; laptop accessed from the PRC | U.S. (Washington; California) | JANG CHOL MYONG |
| On or about June 7, 2021 to June 22, 2021 | U.S. Nonprofit Organization #1, a faith-based nonprofit located in Indiana: IT worker posing as E.H.; extortion threat | U.S. (Indiana) | CHO CHUNG POM |
| In or around February 2022 to on or about March 17, 2023 | U.S. Business #2, a talent hiring firm located in Texas: IT worker under M.H. identity; extortion and leak | U.S. (Texas) | HYON CHOL SONG |