2020 (176)

Date (as written)	Incident	Country	Actors
2020/11/16	Lazarus supply-chain attack in South Korea
2020-11	Nexus Mutual	United Kingdom	Bluenoroff
Since February 2020	Resumed bank targeting: fraudulent international money transfers and ATM cash outs		BeagleBoyz
2020-10	CoinMetro	Estonia	Lazarus
2020-09	KuCoin	Singapore	Lazarus
2020-09	Unibright	Germany	Lazarus
2020-09	Eterbase	Slovakia	Lazarus
2020-08	CoinBerry	Canada	Lazarus
2020-08	HDAC	Korea, Republic of	Thallium
18 Feb 2021	Lazarus: Three North Koreans Charged for Financially Motivated Attacks
2020-07	VHD Ransomware	ZZZ	Lazarus
2020-07	KAMS	Korea, Republic of
2020-02	Bank Rakyat	Indonesia	Lazarus
2021-05-31T17:00:00+00:00	Kimsuky APT continues to target South Korean government using AppleSeed backdoor	South Korea	Kimsuky (Thallium, Black Banshee, Velvet Chollima)
01.01.2020	ThreatNeedle: Defense Industries	Unknown	Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
2021-01-25T23:59:00+00:00 (datePublished)	Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects)		government-backed entity based in North Korea
02/12/20	Six pharmaceutical companies including Johnson & Johnson, Novavax Inc., Genexine Inc., Shin Poong Pharmaceutical Co. and Celltrion Inc.	>1	North Korean hackers
November 2020	CSIS entry 539
2020-11-13T13:59:58+00:00 (published_time)	Cerium targeting Covid-19 vaccine and treatment researchers (WHO-themed spear-phishing)	Canada, France, India, South Korea and the United States (all three actors combined)	Cerium
27/10/2020	Individuals and organizations in South Korea, Japan, and the United States	>1	?
October 2020	CSIS entry 557
23/12/20	Undisclosed pharmaceutical company	N/A	Lazarus Group
mid-March 2020	“Security alert”-themed spear-phishing of 28 individuals including 11 officials from six Security Council members		Kimsuky advanced persistent threat group
August 13, 2020	Operation ‘Dream Job’ Widespread North Korean Espionage Campaign
June 2020	CSIS entry 612
June 2020	CSIS entry 615
March 2020	CSIS entry 639
February 2020	CSIS entry 646
01.09.2020	Unidentified North Korean Hackers Gained Access to an Unnamed Company and Stole Data from the Korea Hydro & Nuclear Power (KHNP) Energy Company in September 2020 and June 2024	Not available;Korea, Republic of	Unknown
2020-03	According to a tweet shared by South Korean cyber-security firm IssueMakersLab, a group of North Korean hackers also hid malware inside documents detailing South Korea's response to the COVID-19 epidemic.		Kimsuky, Velvet Chollima
2021-01-03	탈륨 조직, 사설 주식 투자 메신저 악용해 소프트웨어 공급망 공격 수행		블루 에스티메이트; 탈륨
Jul 29, 2020	Operation (North Star) North Star: A Job Offer That's Too Good to be True?		Hidden Cobra
2020-03	Operation “Spy Cloud”		Reaper, APT 37, Ricochet Chollima, ScarCruft
5/1/2020	COVID disruption_DPRK	US / N Korea
2020-10-01	Alejandro Caceres	United States of America	James Willy
2020-09-03	CNN-News18	India	NGB 3rd Technical Surveillance Bureau
published 2020-08-28	DOJ forfeiture complaint for 280 addresses tied to two exchange hacks		Lazarus Group
2020-08-25	Cryptocurrency exchange	Undetermined	NGB 3rd Technical Surveillance Bureau
2020-01-01	BTC Changers
2020-08-18	Hobocrypt
2020-08-19	Request CEO Hack #1
2020-08-29	Tap Global
2020-10-16	LEAD Wallet Token
2020-11-13	L2 Theft
2020-12-21	Exmo
2020-01-08T10:00:47	Operation AppleJeus Sequel
Since January 2020	AppleJeus campaign against energy, finance, government, industry, technology and telecom sectors in 30+ countries	Argentina, Australia, Belgium, Brazil, Canada, China, Denmark, Estonia, Germany, Hong Kong, Hungary, India, Ireland, Israel, Italy, Japan, Luxembourg, Malta, the Netherlands, New Zealand, Poland, Russia, Saudi Arabia, Singapore, Slovenia, South Korea, Spain, Sweden, Turkey, the United Kingdom, Ukraine, and the United States	HIDDEN COBRA; Lazarus Group
2020-05-12 (report date)	COPPERHEDGE / Manuscrypt targeting of cryptocurrency exchanges		HIDDEN COBRA
October 2020	Second hack (October 2020)		DPRK
since March 2020	VHD, BEAF, PXJ, ZZZZ and ChiChi ransomware		BlueNoroff (also known as APT38) (code similarities)
(published August 31, 2020)	Lazarus attack activity targeting Japanese organisations (malware used after network intrusion)	Japan	Lazarus (also known as Hidden Cobra)
(published September 29, 2020)	Lazarus use of BLINDINGCAN malware (observed by JPCERT/CC)		Lazarus (also known as Hidden Cobra)
2020-11-09	9th November - Threat Intelligence Bulletin
30.7.2020 (date of listing)	“WannaCry”		APT38 / Lazarus Group (Chosun Expo)
(listing 30.7.2020)	Cyber-attacks against the Polish Financial Supervision Authority	Poland	Chosun Expo; APT38 / Lazarus Group
30.7.2020 (date of listing)	cyber-attacks against … Sony Pictures Entertainment		APT38 / Lazarus Group (Chosun Expo)
30.7.2020 (date of listing)	cyber-theft from the Bangladesh Bank		APT38 / Lazarus Group (Chosun Expo)
(listing 30.7.2020)	Attempted cyber-theft from the Vietnam Tien Phong Bank	Vietnam	Chosun Expo; APT38 / Lazarus Group
2020-01-03	微软将朝鲜黑客组织告上法庭——以法律之剑，斩APT组织之链
2020/06/17	Operation In(ter)ception: Aerospace and military companies in the crosshairs of cyberspies
07/06/2020	Multiple online stores	>1	Lazarus Group AKA Hidden Cobra
22/07/2020	Corporate entities from multiple countries	>1	The Lazarus Group AKA HIDDEN COBRA
early this year (report dated 2020-08-19)	Job-posting lure campaign against government/defense contractors (BLINDINGCAN)		HIDDEN COBRA; "A threat group with a nexus to North Korea"
14/08/2020	Multiple targets	US	Hackers from North Korea
March 13, 2020	AppleJeus Version 4: Kupay Wallet (trojanized cryptocurrency application)		HIDDEN COBRA
early 2020	AppleJeus Version 5: CoinGoTrade (trojanized cryptocurrency application)		HIDDEN COBRA
March 2020	AppleJeus Version 6: Dorusio (trojanized cryptocurrency application)		HIDDEN COBRA
Beginning on or before May 6, 2020	CryptoNeuro Trader malicious cryptocurrency application		JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
late 2020	AppleJeus Version 7: Ants2Whale (trojanized cryptocurrency application)		HIDDEN COBRA
In January and February 2020	Spear-phishing of U.S. Department of State, Department of Defense, and U.S. technology companies	U.S.	JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
in or about December 2020 until in or about April 2022	Co-located North Korean IT worker team (traveled to the United Arab Emirates) stealing and laundering virtual currency from victim companies	United Arab Emirates (where team was located)	KIM KWANG JIN; KANG TAE BOK; JONG PONG JU; CHANG NAM IL
Between on or about January 22, 2020, and on or about July 15, 2022	U.S. Nonprofit Organization #2 (child mental health, New York) employed IT worker posing as B.T.	U.S. (New York)	CHOE JONG YONG
October 2020 to October 2023	Christina Marie Chapman laptop farm scheme (more than 300 U.S. companies)	United States	overseas DPRK IT workers with facilitator Christina Marie Chapman
from on or about September 23, 2020, until on or about October 28, 2022	Jason Salazar allowed his identity to be used by overseas DPRK IT workers; received laptops and installed remote access software	U.S. (Georgia)	overseas IT workers (DPRK IT worker scheme); Jason Salazar
published 2020-01-21 (March 2019)	DragonEx exchange breach via fake trading-bot malware	Singapore	Lazarus Group
since at least 2020; As of April 2022	TraderTraitor campaign against blockchain and cryptocurrency firms		Lazarus Group; TraderTraitor; APT38
03/03/2020	South Korea	KR	Kimsuky
2020-05-11	Lazarus’ MacOS Dacls RAT Shows Multi-Platform Ability
2020	Campaign targeting the aeronautics and defence sectors (fake LinkedIn recruiters; ESET “Operation In(ter)ception”)		Lazarus
02/11/2020	Multiple targets in the United States, Russia and Europe	>1	Kimsuky (AKA Velvet Chollima, Black Banshee and Thallium)
2020-06-11	김수키(Kimsuky) APT 그룹, 과거 라자루스(Lazarus) doc 공격 방식 활용		Kimsuky; Lazarus; 김수키; 라자루스
2020-06-05	금성121(Geumseong121) 그룹, 교원 모집 공고문 등으로 변칙적 워터링 홀 공격		Geumseong121; 금성121
2020-05-27	라자루스(Lazarus) 그룹, 한국 증권사 직원을 노린 APT 공격 시도		Lazarus; 라자루스
2020-05-09	Lazarus 그룹의 방위산업체 대상 공격 증가		Lazarus
2020-05-08	통일 정책분야 연구원으로 사칭한 ‘금성121’ APT 공격 주의		Geumseong121; KONNI; Kimsuky; Konni; Lazarus; 금성121; 김수키; 라자루스; 코니
2020-04-28	코로나19 정국에도 ‘라자루스’ 그룹 소행 국내외 APT 공격 증가 주의보		Lazarus; 라자루스
2020-05-29	'북한 내 코로나19 상황 인터뷰' 문건으로 사칭한 김수키 APT 공격 주의!		Kimsuky; Smoke Screen; 김수키; 스모크 스크린
2020-05-27	핵 이슈를 다루는 학술 연구재단을 사칭한 Konni 조직의 새로운 APT 공격		KONNI; Kimsuky; Konni; 김수키; 코니
2020-04-22	코로나 마스크 수요 관심을 노린 코니(Konni) 조직의 APT 공격 주의		KONNI; Konni; 코니
2020-04-10	kimsuky 그룹, 국회의원 선거기간 노린 공격정황 포착		Kimsuky
2020-03-23	국방부 출신 이력서를 위장한 김수키(Kimsuky) 조직의 '블루 에스티메이트 Part7' APT 공격 주의		Kimsuky; 김수키; 블루 에스티메이트
2020-09-03	탈륨 조직, 개성공단 근무자 연구와 아태 연구 논문 투고로 사칭한 APT 공격 주의		Thallium; 탈륨; 페이크 스트라이커
2020-07-25	[스페셜 리포트] 미국 MS가 고소한 탈륨 그룹, 대한민국 상대로 '페이크 스트라이커' APT 캠페인 위협 고조		Fake Striker; Thallium; 탈륨; 페이크 스트라이커
2020-06-30	김수키(탈륨) 조직, 코로나19 테마와 WSF 파일 기반 공격 주의		Kimsuky; Thallium; 김수키; 탈륨
2020-06-19	탈륨조직, 청와대 보안 이메일로 사칭한 APT 공격 수행		Kimsuky; Thallium; 김수키; 블루 에스티메이트; 탈륨
2020-06-02	김수키(Kimsuky) 그룹, HWP, DOC, EXE 복합적 APT 공격 작전		Kimsuky; Smoke Screen; 김수키; 스모크 스크린
2020-03-30	위장 탈북 증거로 유인한 '금성121' APT 조직의 '스파이 클라우드' 공격 등장		Geumseong121; 금성121
2020-12-09	북한 동향정보, 통일 이야기 공모전 문서 사칭… 北 연계 APT 조직 공격 주의보		Geumseong121; Thallium; 금성121; 탈륨
2020-11-22	[스페셜 리포트] 탈륨(김수키)과 코니 APT 그룹의 연관관계 분석 Part3		KONNI; Kimsuky; Konni; Thallium; 김수키; 코니; 탈륨
2020-11-12	北 연계 탈륨조직, '블루 에스티메이트(Blue Estimate)' APT 캠페인 지속		Kimsuky; Thallium; 김수키; 블루 에스티메이트; 탈륨
2020-11-04	북한 연계 해킹조직 탈륨, 미국 대선 예측 언론 문서로 위장한 APT 공격 수행		Smoke Screen; 김수키; 스모크 스크린; 탈륨
2020-10-16	탈륨조직의 국내 암호화폐 지갑 펌웨어로 위장한 다차원 APT 공격 분석		Thallium; 탈륨
2020-03-21	김수키(Kimsuky)조직, 코로나 바이러스 이슈를 악용하여 MacOS MS오피스 사용자를 타겟으로 진행중인 APT 공격 주의!		Kimsuky; 김수키; 스모크 스크린
2020-03-03	김수키(Kimsuky)조직, 비건 미국무부 부장관 서신 내용으로 위장한 APT 공격 수행		Kimsuky; Smoke Screen; 김수키; 스모크 스크린
2020-03-02	이력서로 위장한 김수키(Kimsuky) 조직의 '블루 에스티메이트 Part5' APT 공격 주의		Kimsuky; 김수키; 블루 에스티메이트
2020-02-28	'코로나19' 내용으로 가장한 김수키(Kimsuky) 조직의 스모크 스크린 APT 공격 주의!		Kimsuky; 김수키; 스모크 스크린
2020-02-06	김수키(Kimsuky) 조직, 실제 주민등록등본 파일로 둔갑한 '블루 에스티메이트 Part3' APT 공격 주의		Kimsuky; 김수키; 블루 에스티메이트
2020-01-21	청와대 행사 견적서 사칭 변종, '블루 에스티메이트 Part 2'		김수키; 블루 에스티메이트
2020-01-16	'북한 중앙위원회 전원회의', '2020년 동경 패럴림픽' 관련 문서로 위장한 코니(Konni) APT 그룹 공격 포착		KONNI; Kimsuky; Konni; 김수키; 코니
2020-01-14	‘통일외교안보특보 발표문건’ 사칭 APT 공격… 김수키(Kimsuky) 조직 소행		Kimsuky; Smoke Screen; 김수키; 스모크 스크린
2020-12-17	탈륨조직, 국내 블록체인 기업 체불확인원 문서로 공격 수행		Smoke Screen; Thallium; 스모크 스크린; 탈륨
2020-10-30	10월 북한 내부정보로 현혹하는 탈륨 해킹 조직의 APT 공격		탈륨
2020-10-21	해외 로그인 문자메시지로 위장된 국내 암호화폐 피싱 사이트 주의!!		탈륨
2020-10-13	탈륨 APT 위협 행위자들의 흔적과 악성파일 사례별 비교 분석		탈륨; 페이크 스트라이커
2020-06-15	n번방 이슈를 악용한 Konni 조직의 APT 공격 포착!		KONNI; Konni
2020-11-25	'찌라시'로 위장한 악성 HWP 파일 주의!		Thallium; 탈륨
2020-11-17	바이든 시대, ‘북한 비핵화 협상과 체제 안전 내용’ 담은 APT 공격 징후 발견		탈륨
2020-04-07	라자루스 조직, '인천광역시 코로나바이러스 대응' 제목으로 공격		라자루스
2020-12-17	Trojan.Android.AgentNK 악성코드 분석 보고서		KONNI; Konni; 코니
2020-12-16	금성121 조직, HWP OLE 기반의 APT 공격 진행		금성121; 라자루스
2020-05-27	악성 한글문서(.hwp) 유포 파일명 변화과정 추적		KONNI; Konni; Lazarus; 코니
2020-05-30	악성 한글문서(.hwp) 주제별 연관성 분석		KONNI; Konni; 코니
2020-07-01	법원판결 내용의 악성 엑셀(XLS) 파일 유포: 코니(KONNI) 조직		KONNI; Konni; 코니
2020-09-05	정상 문서 파일로 위장한 악성 코드 유포 (Kimsuky 그룹)		Kimsuky
2020-12-08	“「2021 평화∙통일 이야기 공모전」 참가 신청서” 제목의 한글문서 유포 (APT 추정)		레드아이즈
2020-12-02	수년 만에 세계적 위협이 된 북한, 앞으로 어떻게 변할까?
2020-05-11	Report: N. Korean hacking group increasing efforts to steal cryptocurrency
2020-02-12	[단독] 북한 추정 해커 서버에 쌓여가는 남한 인사들의 스마트폰 정보들		김수키
2020-03-25	APT37 复盘分析报告（part1）：投递与执行		Lazarus; APT37; Reaper
2020-12-18	북 해커, 독일 방산업체 대상 사이버 공격		라자루스
January 2020	At least three Panel experts targeted		cyberactors of the DPRK
March and early April 2020	Spear-phishing of more than 40 official email addresses of a Member State’s executive branch; WhatsApp targeting		Democratic People’s Republic of Korea cyberthreat actors
2020	Phishing emails to Panel experts (fake UN security alert; fake journal editor)
October 2020	Phishing email to a Panel expert spoofed as a UN employee		Kimsuky (a.k.a. Thallium) and Konni (IP address previously used by)
since July 2020	Voice phishing hacking applications sold by Song Rim (continued)	China; Republic of Korea	Song Rim (Munitions Industry Department-linked IT worker)
2020	Kimsuky nuclear and COVID-19 medical espionage		Kimsuky
early 2020s	AppleJeus malware campaign (fake cryptocurrency trading platform)		Citrine Sleet
2020	Japan case 2: individuals assisting North Korean IT workers	Japan	North Korean IT workers / North Korea-affiliated IT companies in China
2020-03-26T16:00:00+00:00 (datePublished)	North Korean (and Iranian) attackers impersonating news outlets or journalists		attackers from Iran and North Korea
2020-11-20T10:00:58	IT threat evolution Q3 2020
2020-05-20T10:00:43	IT threat evolution Q1 2020
2020-04-30	APT trends report Q1 2020 (DPRK-related paragraph 1)
2020-04-30	APT trends report Q1 2020 (DPRK-related paragraph 2)
2020-04-30	APT trends report Q1 2020 (DPRK-related paragraph 3)
2020-04-30	APT trends report Q1 2020 (DPRK-related paragraph 4)
2020-04-30	APT trends report Q1 2020 (DPRK-related paragraph 5)
2020-04-30	APT trends report Q1 2020 (DPRK-related paragraph 6)
2020-04-30	APT trends report Q1 2020 (DPRK-related paragraph 7)
2020-04-30	APT trends report Q1 2020 (DPRK-related paragraph 8)
2020-04-30	APT trends report Q1 2020 (DPRK-related paragraph 9)
2020-05-20	IT threat evolution Q1 2020 (DPRK-related paragraph 1)
2020-05-20	IT threat evolution Q1 2020 (DPRK-related paragraph 2)
2020-07-29	APT trends report Q2 2020 (DPRK-related paragraph 1)
2020-07-29	APT trends report Q2 2020 (DPRK-related paragraph 2)
2020-07-29	APT trends report Q2 2020 (DPRK-related paragraph 3)
2020-07-29	APT trends report Q2 2020 (DPRK-related paragraph 4)
2020-07-29	APT trends report Q2 2020 (DPRK-related paragraph 5)
2020-07-29	APT trends report Q2 2020 (DPRK-related paragraph 6)
2020-07-29	APT trends report Q2 2020 (DPRK-related paragraph 7)
2020-11-03	APT trends report Q3 2020 (DPRK-related paragraph 1)
2020-11-03	APT trends report Q3 2020 (DPRK-related paragraph 2)
2020-11-03	APT trends report Q3 2020 (DPRK-related paragraph 3)
2020-11-20	IT threat evolution Q3 2020 (DPRK-related paragraph 1)
2020-11-20	IT threat evolution Q3 2020 (DPRK-related paragraph 2)
2020-11-20	IT threat evolution Q3 2020 (DPRK-related paragraph 3)
2020-11-20	IT threat evolution Q3 2020 (DPRK-related paragraph 4)
2020-11-20	IT threat evolution Q3 2020. Non-mobile statistics (DPRK-related paragraph 1)
2020-02-26T02:46:14.000Z	DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity - SentinelLabs
2020-07-27T16:59:33.000Z	Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform \| SentinelOne
2020-02-14T08:00:00.000Z	Malware Analysis: HIDDEN COBRA & North Korean Cyber Threats \| FortiGuard Labs
2020-06-23T05:00:00.000Z	Hidden Cobra - from a shed skin to the viper’s nest \| RL Blog
2020-07-21T11:25:46.000Z	Konni APT组织利用核问题、疫情为诱饵针对周边地区的攻击活动分析
2020-04-30T10:55:15.000Z	Lazarus APT组织使用西方某航空巨头招聘等信息针对特定国家的定向攻击事件分析
Reporting Date: 18 June 2020	Global COVID 19-related phishing campaign by North Korean operatives Lazarus Group	Singapore; Japan; South Korea (and three other nations)	Lazarus Group
2020-05-15T00:00:43+00:00	State-sponsored hacker groups join forces to capitalize on COVID-19 pandemic		Lazarus Group (APT38, Hidden Cobra); APT37 (Reaper)
(no date on page; report on cyber espionage trends targeting Japan, fiscal 2020)	Attack using CloudDragon (Kimsuky) and DarkSeoul (Lazarus) VSingle malware against Japan	Japan	CloudDragon (Kimsuky); DarkSeoul attack group (Lazarus attack groups)