| 2018-10 | FASTCash | ZZZ | Hidden Cobra |
| 2016-12 | AkBank | Türkiye | Bluenoroff |
| 2016-10 | Komisja Nadzoru Finansowego | Poland | Bluenoroff |
| 2016-10 | Comisión Nacional Bancaria y de Valores | Uruguay | Bluenoroff |
| 2016-10 | Banco Republica | Uruguay | Bluenoroff |
| 2016-08 | Defense Network | Korea, Republic of | Andariel |
| 2016-07 | Union Bank of India | India | Bluenoroff |
| 2016-07 | Nigerian Bank | Nigeria | Bluenoroff |
| 2016-05 | Standard Bank | South Africa, 🇯🇵 Japan | Bluenoroff |
| 2016-05 | SK/Hanjin | Korea, Republic of | Andariel |
| 2016-04 | DSME#1 | Korea, Republic of | Andariel |
| 2016-03 | Interpark | Korea, Republic of | Andariel |
| 2016-02 | Bangladesh Central Bank | Bangladesh | Bluenoroff |
| 2016-01 | Initech | Korea, Republic of | Andariel |
| March 2016 | CSIS entry 977 | | |
| 2016 | Operation “Erebus” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2016-03 | Operation “Daybreak” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2016-08 | Operation “Golden Time” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2016-11 | Operation “Evil New Year” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 9/5/2016 | US power company hacks | US / N Korea | |
| Aug 2016 | Compromise of computer networks associated with diplomats, journalists, and others in South Korea | South Korea | |
| 9/1/2016 | Anderial | N Korea / S Korea | |
| 2016-10-13 | Bitcurex | | |
| Feb 2016 | Lazarus Group | South Korea, Sony Pictures Entertainment , United States, Bangladesh Bank, Defense companies in Israel and the Middle East, Global banks, U.S. defense contractors | Dark Seoul; malware analysis report; on a tool called Typeframe used by the Lazarus Group.; In September 2018, the U.S. Department of Justice; criminally charged and sanctioned; Park Jin-hyok and Chosun Expo Joint Venture, alleged members of this threat actor. |
| May 2016 | SWIFT-related bank heists | Bangladesh Central Bank, Tien Phong Bank, Banco Del Austro, Poland | Lazarus Group; In September 2018, the U.S. Department of Justice; announced; criminal charges alleging that North Korean entities were responsible for this incident. |
| February 2016; May 2017; November 2014 | Bangladesh Bank; WannaCry 2.0; Sony Pictures Entertainment | | Park Jin Hyok; Chosun Expo Joint Venture |
| 2016 and 2017 | Spear-phishing of U.S. defense contractors including Lockheed Martin | | Park Jin Hyok; "Lazarus Group"; Chosun Expo Joint Venture |
| March 2016 through February 2020 | Spear-phishing of defense, energy, aerospace, technology, State Dept, DoD | | Jon Chang Hyok; Kim Il; Park Jin Hyok (RGB; Lazarus Group / APT38) |
| 2016-01-15 | 청와대 사칭 악성메일 [기사: 청와대 사칭 해킹메일 주범, 한수원 해킹조직 北 ‘김수키’ 유력] | | 김수키(Kimsuky) |
| On July 20, 2016 | Fraudulent wire transfers from the African Bank | Africa | JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB) |
| approximately October 26, 2016 | Watering hole on website of a "South American Bank" | South America | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" |
| 2016-2017 (LinkedIn invitations from March 12, 2016; spear-phishing February 6 and 23, 2017) | Targeting of defense contractors including Lockheed Martin (THAAD prime contractor) and aerospace companies in the U.S. and Israel | U.S.; Israel | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" |
| since 2016 | FALLCHILL malware campaign (aerospace, telecommunications, finance) | | HIDDEN COBRA |
| 27/04/2016 | Several Targets in Asia | >1 | North Korea? |
| 20/05/2016 | Bank in Ecuador | EC | North Korea? |
| 07/09/2016 | Project on Crowdsourced Imagery Analysis (geo4nonpro.org) | US | North Korea? |
| 2016-02-01 | 청와대·공공기관 사칭 악성메일 (2016년 1월 29일) | | 북한 추정 |
| 지난해(2016년) | 청와대 사칭 해킹 메일, 주요 정부 인사의 스마트폰 해킹 시도, 인터파크 해킹 | | 북한 (article frame: 북한발 사이버 도발; not explicit per item) |
| 2016-02-01 | 북한 제작 추정 악성프로그램 변종 발견 | | |
| 2016-05-15 | 제2의 방글라데시 중앙은행 공격 사건 일어났다 | | |
| 2016 and 2017; October 2017 campaign | Spearphishing operation targeting the UNSC 1718 Committee’s Panel of Experts | | cyberactors of the DPRK, probably belonging to the Kimsuky Group |
| 2016-02-24T13:10:07 | Operation Blockbuster revealed | | |
| 2016-05-05 | IT threat evolution in Q1 2016 (DPRK-related paragraph 1) | | |
| 2016-05-05 | IT threat evolution in Q1 2016 (DPRK-related paragraph 2) | | |
| 2016-08-11 | IT threat evolution in Q2 2016. Statistics (DPRK-related paragraph 1) | | |
| 2016-08-11 | IT threat evolution in Q2 2016. Overview (DPRK-related paragraph 1) | | |
| 2016-08-11 | IT threat evolution in Q2 2016. Overview (DPRK-related paragraph 2) | | |
| 2016-08-11 | IT threat evolution in Q2 2016. Overview (DPRK-related paragraph 3) | | |
| 26 May 2016 | SWIFT attackers’ malware linked to more financial attacks | | |