DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

2018 (140)

Date (as written)IncidentCountryActors
2019-09Indian Financial InstituteIndiaLazarus
2018-12RedBancChileHidden Cobra
2018-12Thailand Financial InstituteThailandBluenoroff
2018-12GBNKCenterKorea, Republic of
2018-10Trade.ioSwitzerlandBluenoroff
2018-10Defense Acquisition Program AdministrationKorea, Republic of
2018-10BankIslamiPakistanHidden Cobra
2018-10HSBC MaltaMaltaBluenoroff
2018-09IndodaxIndonesiaBluenoroff
2018-09WaveStringKorea, Republic ofLazarus
2018-09ZaifJapanBluenoroff
2018-08Ryuk RansomwareUnited States, ZZZLazarus
2018-08Cosmos BankIndiaBluenoroff
2018-07BancorSwitzerlandBluenoroff
2018-07Vietnam Financial InstituteViet NamBluenoroff
2018-07RSupportKorea, Republic of
2018-06Bithumb#3Korea, Republic ofBluenoroff
2018-06CoinrailKorea, Republic ofBluenoroff
2018-06Liberian Financial InstitutionLiberiaBluenoroff
2018-05TaylorEstoniaBluenoroff
2018-05Banco de ChileChileBluenoroff
2018-05Simplii FinancialCanadaBluenoroff
2018-05Sejong InstitueKorea, Republic ofAndariel
2018-04Gate.ioCayman IslandsBluenoroff
2018-04CoinSecureIndiaBluenoroff
2018-03Malaysian Central BankMalaysiaBluenoroff
2018-03CypheriumUnited StatesBluenoroff
2018-02City Union BankIndiaBluenoroff
2018-02Punjab National BankIndiaBluenoroff
2018-01CoincheckJapanBluenoroff
2018-01MetrolinxCanada
2018-01BancomextMexicoBluenoroff
2018-01Costa Rican Financial InstitutionCosta RicaBluenoroff
December 2018CSIS entry 779
September 2018CSIS entry 814
May 2018CSIS entry 842
2018-04Operation “GhostSecret”Lazarus Group, Hidden Cobra, Labyrinth Chollima
March 2018CSIS entry 867
March 2018CSIS entry 868
01.01.2018NavRATKorea, Republic ofAPT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067
01.06.2018Andariel Group attacks website of South Korean non-profit organisationKorea, Republic of;Korea, Republic ofAndariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
2018-04The first artefacts we found relating to MATA were used around April 2018. After that, the actor behind this advanced malware framework used it aggressively to infiltrate corporate entities around the world.Lazarus Group, Hidden Cobra, Labyrinth Chollima
2018-03Operation “Baby Coin”Kimsuky, Velvet Chollima
2018-10Operation “Mystery Baby”Kimsuky, Velvet Chollima
2/1/2019Babyshark - USUS / N Korea
2018-01F-Secure’s investigation revealed that a system administrator from the target organization received a phishing document via their personal LinkedIn account. The document masqueraded as a legitimate job advert for a role in a blockchain technology company that matched the employee’s skills.Lazarus Group, Hidden Cobra, Labyrinth Chollima
2018-08Operation “AppleJeus”Lazarus Group, Hidden Cobra, Labyrinth Chollima
2018-07Operation “CryptoCore”Lazarus Group, Hidden Cobra, Labyrinth Chollima
2018-11More Attacks on Cryptocurrency BusinessesLazarus Group, Hidden Cobra, Labyrinth Chollima
2018-01Operation “Evil New Year 2018”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-03Operation “Battle Cruiser”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-04Operation “Star Cruiser”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-05Operation “Onezero”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-08Operation “Rocket Man”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-11Operation “Korean Sword”Reaper, APT 37, Ricochet Chollima, ScarCruft
2018-04-19E7 Theft
2018-04-25OBZ ICO
2018-06-16G13 Theft
2018-08-07BTC Markets
2018-08-09Klickl / IDCM
2018-11-04Kryptono
2018-08-??Unidentified Company
2018-02-20 (datePublished)APT37 (Reaper) operations incl. zero-days and wiper malwarePrimarily South Korea – though also Japan, Vietnam and the Middle EastAPT37 (Reaper; Scarcruft; Group123)
2018-10-03 (datePublished)APT38 financial crime against banks worldwide (since at least 2014)at least 13 countriesAPT38
Feb 2018Targeting of global financial organizations and bitcoin usersLazarus Group; Suspected state sponsor; Korea (Democratic People's Republic of); Type of incident; Espionage; Target category; Private sector; Read more; Lazarus Resurfaces, Targets Global Banks and Bitcoin Users; Footer; Logo; About; Member Programs; Contact; Support; For Media; Newsletters; Membership; Careers; Facebook; YouTube; Instagram; LinkedIn; ©2026 Council on Foreign Relations.; All rights reserved.; Privacy Policy; and; Terms of Use; .
May 2018Targeting of North Korean defectors and journalistsSouth KoreaLazarus Group
Sep 2018Targeting of U.S. defense contractorsUnited StatesLazarus Group
Oct 2018Attempted theft of 2.6M USDBangladeshSuspected DPRK (annex title)
2018ATM cash-out operation, a bank in IndiaIndiaNorth Korean co-conspirators
mid-2018 (learned of hack in late 2018)Hack of The Exchange 1 via malware downloaded by an employee communicating with a "potential client" (Celas Trade Pro / Fallchill)South Korea (three of the four exchanges were based in South Korea)North Korean co-conspirators
August 6, 2018Examining Code Reuse Reveals Undiscovered Links Among North Korea’s Malware Families (DarkSeoul, Operation Troy, 10 Days of Rain, WannaCry)Lazarus, Silent Chollima, Group 123, Hidden Cobra, DarkSeoul, Blockbuster, Operation Troy, 10 Days of Rain
in or about the summer of 2018Theft from The Exchange 4, a South Korea-based virtual currency exchangeSouth KoreaNorth Korean co-conspirators
Between in or about 2018 through in or about April 2019Laundering of Exchange 1 and Exchange 2 hack proceeds by Tian Yinyin and Li JiadongChina (Chinese OTC traders)Tian Yinyin; Li Jiadong; North Korean co-conspirators
Beginning in March 2018Spear-phishing of employees of cryptocurrency exchangesJON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
Beginning on or before October 11, 2018WorldBit-Bot malicious cryptocurrency applicationJON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
Beginning on November 14, 2018WorldBit-Bot advertised to cryptocurrency exchange employeesJON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
Between in or around December 2018 and in or around July 2022U.S. Business #3, an application company located in North Carolina, employed IT worker posing as P.C.U.S. (North Carolina)KO CHUNG SOK
From as early as in or around April 2018 ... through in or around August 2024North Korean IT workers Jin Sung-Il and Pak Jin-Song obtained remote IT work at at least 64 U.S. companies via facilitators Pedro Alonso, Erick Ntekereze Prince and Emanuel Ashtor (Taggcar Inc., Vali Tech Inc.)U.S.JIN SUNG-IL; PAK JIN-SONG; PEDRO ERNESTO ALONSO DE LOS REYES; ERICK NTEKEREZE PRINCE; EMANUEL ASHTOR
8 Nov 2018FASTCash: How the Lazarus Group is Emptying Millions from ATMs
29/05/2018Multiple TargetsUSHidden Cobra
2018Attempted FASTCash incident at a bank in AfricaBeagleBoyz
Towards the end of 2018 through 2019 and in early 2020Job-application themed phishing against financial institutionsBeagleBoyz
2018Kimsuky malicious Google Chrome Web Store extension stealing passwords and cookiesKimsuky
02/01/2018Unnamed South Korean CompanyKRAndariel
08/01/2018Single Individuals>1?
16/01/2018Multiple targets mainly in South KoreaKRGroup 123
16/01/2018Several cryptocurrency exchanges such as Coinlink.>1?
2018-02-02금성121, Flash Player Zero-Day (CVE-2018-4878) 공격 주의Geumseong121; 금성121
06/02/2018Multiple Targets>1Hidden Cobra, aka Lazarus Group
12/02/2018Bitcoin users and global financial organizations.>1Hidden Cobra, aka Lazarus Group
31/05/2018South KoreansKRAndariel Group
14/06/2018Multiple TargetsUSHidden Cobra
15/06/2018Multiple Targets in Singapore>1?
22/06/2018cryptocurrency exchanges>1?
09/08/2018US OrganizationsUSHidden Cobra
2018-09-27T08:00:04New KONNI Malware attacking Eurasia and Southeast Asia
20/11/2018Latin American financial institutions>1Lazarus Group
2018-02-12오퍼레이션 김수키(Kimsuky)의 은밀한 활동, 한국 맞춤형 APT 공격은 현재 진행형Kimsuky; 김수키
2018-11-132018년 11월 Lazarus 그룹 한국과 미국 서버를 이용해 APT 공격 수행 중Lazarus; 라자루스
2018-10-23라자루스 최신 APT 작전 '배틀 크루저(Operation Battle Cruiser)' 재등장Lazarus; 라자루스
2018-09-20라자루스(Lazarus) APT, 유령 꼭두각시(Operation Ghost Puppet)Lazarus; 라자루스
2018-06-19김수키(Kimsuky) APT조직, 미북 정상회담 전망 및 대비 문서로 공격Kimsuky; 김수키
2018-05-31안보·대북 연구기관 등을 상대로 한 APT 공격, '작전명 물 탱크(Operation Water Tank)'Kimsuky; 김수키
2018-12-13'오퍼레이션 블랙버드(Operation Blackbird)', 금성121의 모바일 침공금성121
2018-07-04'금성121' 그룹의 '남북이산가족찾기 전수조사' 사칭 이메일 주의Geumseong121; 금성121
2018-11-27안보·외교·통일 관련 분야를 겨냥한 APT 공격, '작전명 블랙 리무진' 주의Kimsuky; 김수키
2018-10-18새로운 KONNI 캠페인 등장, '작전명 해피 바이러스(Operation Happy Virus)'KONNI; Konni
2018-02-05가상화폐 거래소 및 회원 해킹 (2017년; 야피존(현 유빗), 빗썸 포함)북한
2018-02-13평창올림픽 홈피 공격, 악성코드 침투시킨 사이버테러였다
2018-02-172018년 주목해야 할 정부지원 해킹그룹 8라자루스; 스카크러프트; 블루노로프
2018-05-23해커그룹 안다리엘, 액티브X 취약점 악용 국내 지속 공격Lazarus; 라자루스; Andariel; 안다리엘
2018-07-13북한 배후 해커그룹 '안다리엘' 10년 추적기Andariel; 안다리엘
April 06, 2018STARDUST CHOLLIMA operations against financial institutions incl. SWIFT abuse; suspected targeting of Latin America-based organizations since mid-2017Latin America-basedSTARDUST CHOLLIMA
June 25, 2018DPRK targeted intrusion activity in 2017 and 2018 (Australia commentary; WannaCry, Sony, Bangladesh Bank cited)BangladeshDPRK adversaries
2018-04-12APT Trends report Q1 2018 (DPRK-related paragraph 1)
2018-04-12APT Trends report Q1 2018 (DPRK-related paragraph 2)
2018-04-12APT Trends report Q1 2018 (DPRK-related paragraph 3)
2018-05-14IT threat evolution Q1 2018 (DPRK-related paragraph 1)
2018-05-14IT threat evolution Q1 2018 (DPRK-related paragraph 2)
2018-07-10APT Trends Report Q2 2018 (DPRK-related paragraph 1)
2018-07-10APT Trends Report Q2 2018 (DPRK-related paragraph 2)
2018-07-10APT Trends Report Q2 2018 (DPRK-related paragraph 3)
2018-07-10APT Trends Report Q2 2018 (DPRK-related paragraph 4)
2018-07-10APT Trends Report Q2 2018 (DPRK-related paragraph 5)
2018-07-10APT Trends Report Q2 2018 (DPRK-related paragraph 6)
2018-11-12IT threat evolution Q3 2018 | Securelist (DPRK-related paragraph 1)
2018-11-12IT threat evolution Q3 2018 | Securelist (DPRK-related paragraph 2)
2018-11-12IT threat evolution Q3 2018 | Securelist (DPRK-related paragraph 3)
2018-11-12IT threat evolution Q3 2018 | Securelist (DPRK-related paragraph 4)
2018-12-05APT Review of the year (DPRK-related paragraph 1)
2018-12-05APT Review of the year (DPRK-related paragraph 2)
2018-12-05APT Review of the year (DPRK-related paragraph 3)
2018-12-05APT Review of the year (DPRK-related paragraph 4)
2018-10-01T08:00:17NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT
2018-04-05T13:00:40Reaper Group’s Updated Mobile Arsenal
2018-11-20Lazarus Targets Latin American Financial Companies
2018-01-24Lazarus Campaign Uses Remote Tools, RATANKBA, and More
2018/04/03Lazarus KillDisks Central American casino
February 8, 2018Hermes ransomware used as diversion in a bank heist in Taiwan; Hermes 2.1TaiwanLazarus group
October 31, 2018Paleontology: The Unknown Origins of Lazarus Malware (CasperPhpTrojan)Lazarus