| 2014-12 | Sony Pictures Entertainment | United States | Lazarus |
| On December 2 and 3, 2014 | Spear-phishing of AMC Theatres employees | U.S. | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| At an unknown date in 2015 | Unauthorized access to Mammoth Screen computers | United Kingdom | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| On December 9, 2015 | Fraudulent wire transfers from the Vietnamese Bank | Vietnam | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| Beginning in or around November 2015 | Intrusion at the Philippine Bank (no fraudulent transfers) | Philippines | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| 2016-10 | Komisja Nadzoru Finansowego | Poland | Bluenoroff |
| 2016-10 | Comisión Nacional Bancaria y de Valores | Uruguay | Bluenoroff |
| 2016-02 | Bangladesh Central Bank | Bangladesh | Bluenoroff |
| March 2016 through February 2020 | Spear-phishing of defense, energy, aerospace, technology, State Dept, DoD | | Jon Chang Hyok; Kim Il; Park Jin Hyok (RGB; Lazarus Group / APT38) |
| On July 20, 2016 | Fraudulent wire transfers from the African Bank | Africa | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| approximately October 26, 2016 | Watering hole on website of a "South American Bank" | South America | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" |
| 2016-2017 (LinkedIn invitations from March 12, 2016; spear-phishing February 6 and 23, 2017) | Targeting of defense contractors including Lockheed Martin (THAAD prime contractor) and aerospace companies in the U.S. and Israel | U.S.; Israel | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" |
| 2017-10 | Far Eastern International Bank | Taiwan | Bluenoroff |
| 2017-06 | Bithumb#2 | Korea, Republic of | Bluenoroff |
| 2017-05 | WannaCry Ransomware | ZZZ, 🇷🇺 Russian Federation, 🇯🇵 Japan, 🇬🇧 United Kingdom, 🇫🇷 France, 🇰🇷 Korea, Republic of, 🇮🇳 India, 🇨🇳 China, 🇩🇪 Germany, 🇪🇸 Spain, 🇮🇩 Indonesia, 🇧🇷 Brazil, 🇺🇸 United States | Lazarus |
| On August 24, 2017 | Ransomware and extortion of a victim company | | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| On October 13, 2017 | Extortion of Central American Online Casino 1 after theft of customer information | Central America | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| On November 2, 2017 | Extortion of Central American Online Casino 2 after theft of customer information | Central America | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| On December 15, 2017 | Theft from Slovenian Cryptocurrency Company (crypto-mining company, Ljubljana) | Slovenia | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| Beginning in February 2017 and continuing through May 2017 | Spear-phishing of U.S. cleared defense contractors | U.S. | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| 2018-10 | BankIslami | Pakistan | Hidden Cobra |
| 2018-09 | Indodax | Indonesia | Bluenoroff |
| 2018-01 | Bancomext | Mexico | Bluenoroff |
| 2018-08 | Operation “AppleJeus” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| Beginning in March 2018 | Spear-phishing of employees of cryptocurrency exchanges | | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| Beginning on or before October 11, 2018 | WorldBit-Bot malicious cryptocurrency application | | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| Beginning on November 14, 2018 | WorldBit-Bot advertised to cryptocurrency exchange employees | | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| 2019-02 | Bank of Valletta | Malta | |
| Beginning on or before March 6, 2019 | iCryptoFx malicious cryptocurrency application | | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| Beginning on April 27, 2019 | Fake employee personas for iCryptoFx | | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| December 2019 | AppleJeus Version 3: Union Crypto (trojanized cryptocurrency application) | | HIDDEN COBRA |
| In November 2019 | Spear-phishing of U.S. Department of State employees | U.S. | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| March 13, 2020 | AppleJeus Version 4: Kupay Wallet (trojanized cryptocurrency application) | | HIDDEN COBRA |
| early 2020 | AppleJeus Version 5: CoinGoTrade (trojanized cryptocurrency application) | | HIDDEN COBRA |
| March 2020 | AppleJeus Version 6: Dorusio (trojanized cryptocurrency application) | | HIDDEN COBRA |
| Beginning on or before May 6, 2020 | CryptoNeuro Trader malicious cryptocurrency application | | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| late 2020 | AppleJeus Version 7: Ants2Whale (trojanized cryptocurrency application) | | HIDDEN COBRA |
| In January and February 2020 | Spear-phishing of U.S. Department of State, Department of Defense, and U.S. technology companies | U.S. | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| 2022-03 | Arkansas Healthcare Company | United States | Andariel |
| 2022-11 | Massachusetts Defense Company | United States | Andariel |
| 2022-04 | Michigan Defense Company | United States | Andariel |
| 2022-04 | Randolph Air Force Base | United States | Andariel |
| 2022-04 | Robins Air Force Base | United States | Andariel |
| 2022-04 | Oregon Defense Company | United States | Andariel |
| 2022-03 | Connecticut Healthcare Company | United States | Andariel |
| 2022-03 | Florida Hospital | United States | Andariel |
| 2022-03 | Colorado Medical Clinic | United States | Andariel |
| 2022-03 | California Defense Company | United States | Andariel |
| 2022-02 | NASA | United States | Andariel |
| 2022-01 | Chinese Energy Company | China | Andariel |
| 2023-03 | South Korean Manufacturing Company | Korea, Republic of | Andariel |
| 2023-01 | Taiwanese Defense Company | Taiwan | Andariel |
| 2023 | Data exfiltrated from "South Korean Defense Company 1" | South Korea | RIM JONG HYOK and Conspirators; RGB cyber unit known as Andariel, Onyx Sleet, and Silent Chollima |
| 2023 | Data exfiltrated from "South Korean Defense Company 2" | South Korea | RIM JONG HYOK and Conspirators; RGB cyber unit known as Andariel, Onyx Sleet, and Silent Chollima |
| Intrusion at the "Southeast Asian Bank" | Southeast Asia | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" |
| Spear-phishing and social engineering of South Korean companies and government entities; reconnaissance of U.S. and South Korean military | South Korea | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" |