| 2024-07-15T00:00:00Z | Hunting Lazarus: Expanding Indicators with Historic DNS (meeting-themed phishing domains) | | Lazarus Group (APT38) |
| 2025-02 | Bybit | United Arab Emirates | Lazarus |
| 2025-01-16T00:00:00Z | Lazarus APT: Techniques for Hunting Contagious Interview (ClickFix fake video job interviews) | | Lazarus APT |
| 2025-06-18T05:00:00.000Z | Inside the BlueNoroff Web3 macOS Intrusion Analysis (Feeling Blue(Noroff)) | | TA444 aka BlueNoroff, Sapphire Sleet, COPERNICIUM, STARDUST CHOLLIMA, CageyChameleon |
| 2025-07-22T00:00:00Z | Previously unreported domain associated with TraderTraitor Bybit activity (in "Substantial Upgrades to Crawling History") | | Lazarus Group (TraderTraitor) |
| 2025-11-20T00:00:00Z | Inside DPRK’s Fake Job Platform Targeting U.S. AI Talent (lenvny[.]com) | U.S. | DPRK-linked Contagious Interview operation |
| 2026-02-09 (datePublished) | UNC1069 intrusion at a FinTech entity using compromised Telegram account, fake Zoom meeting and deepfake | | UNC1069 |