| 2025-05 | LND | | |
| 2023-01 | Seoul Central District Court | Korea, Republic of | Lazarus |
| 2022-07 | Maui Ransomware | United States, 🇯🇵 Japan | Andariel |
| 2022-03 | Arkansas Healthcare Company | United States | Andariel |
| 2021-11 | bZx | United States | Bluenoroff |
| 2021-10 | DSME#2 | Korea, Republic of | |
| 2021-10 | MGNR | United States | Bluenoroff |
| 2021-08 | Liquid | Japan | |
| 2021-07 | Bondly Finance | United States | Bluenoroff |
| 2021-06 | Fetch.ai | United Kingdom | |
| 2021-06 | Seoul National University Hospital | Korea, Republic of | |
| 2021-06 | Korea Aerospace Industries | Korea, Republic of | Kimsuky |
| 2021-06 | Korea Atomic Energy Research Institute | Korea, Republic of | |
| 2021-05 | FinNexus | Virgin Islands, British | Bluenoroff |
| 2021-04 | EasyFi | India | Bluenoroff |
| January 2022 | CSIS entry 396 | | |
| December 2021 | CSIS entry 401 | | |
| September 2021 | CSIS entry 422 | | |
| 2021-03-31T16:00:00+00:00 (datePublished) | Fake offensive security company "SecuriElite" set up to target security researchers | Turkey (claimed location of fake company) | North Korean government-backed entity |
| February 2021 | CSIS entry 509 | | |
| 01.01.2021 | State-sponsored North Korean hacking group Lazarus deployed newly discovered backdoor WinorDLL64 against unspecified South Korean targets since 2021 | Korea, Republic of | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.10.2021 | North Korean state-sponsored hacker group Lazarus gained access to the corporate network of an aerospace company in the Netherlands in October 2021 | Netherlands | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2021-03 | ScarCruft surveilling North Korean defectors and human rights activists | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| November 18, 2021 | TA406 credential theft campaigns (2021) against foreign policy experts, journalists and NGOs | | TA406 (part of Kimsuky / Thallium / Konni) |
| 2021-08-19T17:00:00+00:00 | New variant of Konni malware used in campaign targeting Russia | Russia | APT37 (Konni, potentially linked) |
| 01.11.2021 | BlueNoroff hackers steal crypto using fake MetaMask extension | United States;Russia;China;India;United Kingdom;Ukraine;Poland;Czech Republic;United Arab Emirates;Germany | Blue Noroff/APT38/Stardust Chollima/G0082/Sapphire Sleet fka COPERNICUM/Genie Spider < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.06.2021 | Kimsuky vs. South Korean think tanks | Korea, Republic of | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 01.05.2021 | DeathNote cluster | Korea, Republic of;Korea, Republic of;Latvia;Latvia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2021 | North Korean defector Kang Mi-Jin | Korea, Democratic People's Republic of;Korea, Democratic People's Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 2021-11-10T22:11:00.000Z | North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets | | |
| 2021-03 | Lazarus Attack Activities Targeting Japan (VSingle/ValeforBeta) | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2021-06 | APT actor Lazarus attacks defense industry, develops supply chain attack capabilities | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 10/11/2021 | Security Researchers worldwide | >1 | Lazarus Group AKA HIDDEN COBRA |
| 2021-04 | North Korean APT InkySquid Infects Victims Using Browser Exploits | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2021-01-22 | Indodax ATO | | |
| 2021-02-18 | BOLT Token Holder | | |
| 2021-03-05 | Paid Network | | |
| 2021-03-16 | GaijinEagle | | |
| 2021-04-02 | Mudge / Etna / Mokens Deployer | | |
| 2021-05-12 | 990.1 BTC | | |
| 2021-06-03 | NAOs Finance | | |
| 2021-06-21 | Market Maker | | |
| 2021-06-23 | Coinsquare | | |
| 2021-07-13 | Tower Capital | | |
| 2021-07-13 | Advcash | | |
| 2021-08-01 | Aug Sept Oct 2021 Hacks | | |
| 2021-08-12 | DAO Maker | | |
| 2021-10-28 | Metaplay / Polyplay | | |
| 2021-11-01 | YFETH Admin Key | | |
| 2021-11-26 | SCC | | |
| Nov 2021 | Targeting of Chinese cybersecurity researchers. | Chinese hacking groups | Lazarus Group |
| 2021-07-12 | 12th July – Threat Intelligence Report | | |
| Apr 2021 | Targeting of South African freight companies | South African shipping companies | Lazarus Group |
| 2021-06-15T12:40:11 | Andariel evolves to target South Korea with ransomware | | |
| 26/11/2021 | Employees at South Korean security companies | KR | Attackers from North Korea (Zinc) |
| 2021-08-17T16:15:15+00:00 (published_time) | InkySquid strategic web compromise of Daily NK delivering BLUELIGHT (late March to early June 2021) | South Korean | InkySquid (ScarCruft, APT37) |
| December 4th, 2021 | Bitmart Hack | | |
| 2021-01-05T17:00:00+00:00 | Retrohunting APT37: VBA self decode technique to inject RokRat | | APT37 |
| 2021년 4월부터 1년 동안; 지난해 6월부터 | 금융 보안인증 프로그램(이니텍) 해킹 및 워터링 홀로 61개 기관 PC 207대 해킹 | | 라자루스 (北정찰총국) |
| (published January 20, 2021) | Lazarus use of common tools (AdFind, SMBMap, Responder-Windows, WinRAR, VNC, ProcDump) after intrusion | | Lazarus attack group, a.k.a. Hidden Cobra |
| 2021 | North Korean cyber espionage in western states against security/defence, aerospace and finance (blockchain) companies | | Nordkoreanische Nachrichtendienste |
| 2021-01-25 | 25th January - Threat Intelligence Report | | |
| 2021-02-08 | 8th February - Threat Intelligence Report | | |
| May 24, 2021 | Attributing CryptoCore Attacks Against Crypto Exchanges to LAZARUS (North Korea) | | |
| 2021-06-22 | NukeSped Copies Fileless Code From Bundlore, Leaves It Unused | | |
| 2021-11-01 | 1st November – Threat Intelligence Report | | |
| in or around August 2021 | Theft from COMPANY-1, a Japan-based virtual currency exchange | Japan | North Korean cyber actors; Lazarus Group and APT38 |
| Between on or about October 18, 2021, and on or about April 15, 2022 | U.S. Business #4, an internet streaming technology company located in Iowa, employed IT worker posing as R.W. | U.S. (Iowa) | CHOE JONG YONG |
| On or about September 15, 2021 to October 29, 2021 | U.S. Business #5 (staffing, Washington) and U.S. Business #6 (technology, California): IT worker posing as J.S.; laptop accessed from the PRC | U.S. (Washington; California) | JANG CHOL MYONG |
| On or about June 7, 2021 to June 22, 2021 | U.S. Nonprofit Organization #1, a faith-based nonprofit located in Indiana: IT worker posing as E.H.; extortion threat | U.S. (Indiana) | CHO CHUNG POM |
| Between 2021 and 2024 | Minh Phuong Ngoc Vong laptop farm: overseas co-conspirator (John Doe, working for the North Korean government) performed work at 13 U.S. companies and U.S. government agencies, including an FAA-related software application | U.S. (Maryland); China (Shenyang) | John Doe (co-conspirators were, in fact, working for the North Korean government); Minh Phuong Ngoc Vong |
| Beginning in at least September of 2021, through up to and including May 16, 2024 | Oleksandr Didenko's Upworksell.com identity-rental service and U.S. laptop farms used by overseas (North Korean) IT workers | U.S. (laptop farms incl. Virginia, Tennessee) | overseas IT workers (some clients "are from North Korea"); Oleksandr Didenko |
| In 2021 | OTC conversion of stolen virtual currency for Lazarus Group (Wu Huihui, Cheng Hung Man) | | Lazarus Group |
| Since September 2021 | Sim Hyon Sop receiving IT-worker and stolen-crypto funds | | Sim Hyon Sop (KKBC); DPRK IT workers |
| as recently as 2021 | IT teams in China and Russia remitting cryptocurrency (Kim Sang Man / Chinyong) | | Chinyong Information Technology Cooperation Company; DPRK IT workers |
| Since at least 2021 | Chonsurim IT workers in Laos using falsified credentials | Laos | Chonsurim Trading Corporation (Department 53) |
| Since 2021 | Shenyang Geumpungri IT worker delegation (Chinyong front) | China | Chinyong; Shenyang Geumpungri Network Technology Co., Ltd; Korea Sinjin Trading Corporation |
| 2021-02-17 | Funds stolen from a New York-based financial services company (seized for return) | United States | DPRK hackers |
| Between 2021 and 2024 | Vong remote IT worker scheme (13 U.S. companies; FAA access) | United States | John Doe aka William James (Shenyang, China) |
| From approximately 2021 until October 2024 | Kejia Wang / Zhenxing Wang laptop-farm IT worker scheme (100+ U.S. companies) | United States | DPRK IT workers |
| 03/03/2021 | Multiple targets | >1 | Hidden Cobra AKA Lazarus Group |
| 2021-04-14T08:29:32+00:00 | Lazarus BTC Changer | | |
| 19/04/2021 | Targets in South Korea | KR | Lazarus Group AKA Hidden Cobra |
| 20/06/2021 | Daewoo Shipbuilding & Marine Engineering (DSME) | KR | Attackers from North Korea |
| 15/10/2021 | Security researchers | >1 | North Korean government threat actors |
| 14/12/2021 | Multiple organizations | >1 | Threat actors originating from China, Iran, North Korea, and Turkey |
| 2021-09-07 | 북한 최근 정세 칼럼으로 위장한 北 연계 '금성121' APT 공격 주의! | | 금성121 |
| 2021-06-02 | 라자루스 APT 그룹, 중국 정부 및 기업 대상으로 피싱 공격 수행해 | | HIDDEN COBRA; Hidden Cobra; Lazarus; 라자루스 |
| 2021-05-26 | 금융거래 · 사례비 지급 명목으로 접근하는 해킹 피해 우려 | | Kimsuky; Thallium; 김수키; 라자루스; 탈륨 |
| 2021-08-03 | 北 연계 사이버 위협 조직 탈륨, PDF 문서 취약점 이용한 공격 수행 | | Fake Striker; 탈륨; 페이크 스트라이커 |
| 2021-07-01 | 북한 탈륨 그룹, 구글 블로그 이용한 해킹 공격 수행 | | 김수키; 탈륨 |
| 2021-06-25 | 통일부, 통일연구원 공식 이메일 둔갑… 北 연계 탈륨 해킹 공격 주의보 | | 김수키; 탈륨 |
| 2021-05-12 | '북한비핵화’ 관련 내용 담은 악성문서 유포 | | Thallium; 탈륨 |
| 2021-05-07 | 탈륨 조직, 2021년 외교부 재외공관 복무 관련 실태 조사 위장 공격 | | Thallium; 블루 에스티메이트; 탈륨 |
| 2021-11-11 | 北 평양과학기술대학 총장을 사칭한 CVE-2021-40444 취약점 공격 주의 | | 북한 정찰총국; 정찰총국 |
| 2021-11-09 | 북한 정찰총국 해킹 조직, 한국 싱크탱크 사칭으로 국방,안보전문가 표적 공격! | | Fake Striker; 북한 정찰총국; 정찰총국; 페이크 스트라이커 |
| 2021-10-28 | 北 연계 APT 조직 탈륨(Thallium), 故 노태우 조문 네이버 뉴스로 사칭한 해킹 공격 시도 | | Thallium; 북한 정찰총국; 정찰총국; 탈륨 |
| 2021-08-13 | 통일부 사칭, 北 연계 APT공격 등장… ‘사이버 공격 주의 업무로 둔갑’ | | 스모크 스크린; 탈륨 |
| 2021-09-23 | 탈륨(Thallium) 조직, 한국통신사업자연합회 사칭 스피어 피싱 공격 중 | | Kimsuky; Thallium; 김수키; 탈륨 |
| 2021-02-03 | 코니(Konni)조직을 탈륨(Thallium)으로 통합 분류 | | KONNI; Kimsuky; Konni; Thallium; 김수키; 코니; 탈륨 |
| 2021-02-01 | 탈륨 조직, 북한경제분야 활동 러시아 연구원 상대로 정교한 사이버 공격 수행 | | KONNI; Konni; Thallium; 김수키; 코니; 탈륨 |
| 2021-01-21 | Trojan.Android.AgentNK 악성코드 분석 보고서 | | Kimsuky; Thallium; 김수키; 탈륨 |
| 2021-01-18 | 바이든 행정부 출범 기획 설문 위장한 공격 등장 ‘탈륨’ 조직 소행 추정 | | Kimsuky; Thallium; 김수키; 탈륨; 페이크 스트라이커 |
| 2021-01-24 | 탈륨 조직, 2021 코로나19 대응 기부증서 사칭 스피어 피싱 공격 수행 | | Thallium; 탈륨 |
| 2021-04-20 | 라자루스 및 탈륨조직, 외교·안보·국방·통일 분야 전문가 대상 표적 공격 급증 주의보 | | Lazarus; Thallium; 라자루스; 탈륨 |
| 2021-03-10 | 외교안보 전문가 대상 표적 공격 급증 주의보 ‘탈륨’ 조직 연루 | | Thallium; 탈륨 |
| 2021-02-24 | 탈륨 조직, 통일부 월간북한동향 문서 사칭 공격 수행 | | Thallium; 탈륨 |
| 2021-02-17 | 탈륨 조직, 코로나19 관련 소상공인 지원 종합안내로 위장한 HWP 공격 | | 탈륨 |
| 2021-02-08 | 탈륨 조직, 북한 제8차 당대회 평가내용 문서로 사이버 공격 감행 | | Thallium; 탈륨 |
| 2021-08-06 | 북한 연관 그룹 추정 PDF 문서를 이용한 APT 공격 | | Kimsuky; 김수키 |
| 2021-08-24 | ‘수출용 골드바 매매 계약서’로 위장한 악성 워드문서 | | Kimsuky |
| 2021-09-10 | kakaoTest.exe 파일명의 Kimsuky 제작 추정 악성코드 | | Kimsuky |
| 2021-09-27 | Kimsuky 그룹에서 사용하는 VNC 악성코드 (TinyNuke, TightVNC) | | Kimsuky |
| 2021-10-13 | 특정 항공사 자소서로 위장한 RTF 악성코드 | | Lazarus; 라자루스 |
| 2021-10-15 | 특정 논문의 악성 워드 문서를 이용한 APT 공격 | | Kimsuky; 김수키 |
| 2021-11-10 | Lazarus 그룹의 NukeSped 악성코드 분석 보고서 | | Lazarus |
| 2021-11-15 | KIMSUKY 조직의 Operation Light Shell | | Kimsuky |
| 2021-11-16 | Analysis Report on Kimsuky Group’s APT Attacks (AppleSeed, PebbleDash) | | Kimsuky; Lazarus |
| 2021-12-21 | Kimsuky 그룹의 APT 공격사례 (PebbleDash) | | Kimsuky |
| 2021-12-24 | 대북 관련 한글문서(HWP) 유포 중 | | Kimsuky |
| 2021-06-30 | 김수키 등 북한 연계 해커조직 공격 기승! 원자력연·KAI는 ‘빙산의 일각’ | | Kimsuky; 김수키 |
| 2021-06-21 | 원자력연구원·대우조선해양 등 방산업체 연쇄 해킹 | | 북한 추정 해커 세력 |
| 2021-07-13 | Matryoshka : Variant of ROKRAT, APT37 (Scarcruft) | | APT37; Scarcruft |
| 2021-07-08 | Analysis of Lazarus malware abusing Non-ActiveX Module in South Korea | | Lazarus |
| 2021-01-27 | Analysis of THREATNEEDLE C&C Communication (feat. Google TAG Warning to Researchers) | | Lazarus |
| 2021-11-24 | 【APT情报局】 揭秘APT-C-55（Kimsuky）“大本营” | | |
| 2021-01-27 | 카스퍼스키 "北 공격 지속…해킹조직 활동량·덩치 커졌다" | | 라자루스; 김수키 |
| 2021-07-05 | [이슈분석]사이버전사 7000명…북한 해킹조직 구성은 | | |
| 2021-07-05 | [이슈분석]끊이지 않는 해킹 위협, 대책은 | | |
| 2021-02-17 | 北 화이자 해킹설 진실공방… 법사위선 '김명수 대법원장 출석요구' 부결 | | |
| 2021-02-03 | 攻撃グループ「Lazarus」のマルウェア情報を公開 - JPCERT/CC | | Lazarus; Hidden Cobra |
| 2021-06-28 | 도 넘은 北 해킹… 정부기관·방산업체 전방위 사이버 공격 | | |
| 2021-07-21 | 보안업계 상반기 주요 키워드 '북한·랜섬웨어' | | |
| since the start of 2021 | 350 instances of cyberactivity against one Member State government institution | | |
| likely between late 2021 and May 2022 | Compromise of the email server and internal network of NPO Mashinostroyenia | Russian Federation | ScarCruft and the Lazarus Group (separate intrusions) |
| between May 2021 and March 2023 | Six ransomware incidents affecting victims in the United States and the ROK | United States; Republic of Korea | Rim Jong Hyok (Andariel) |
| October 2021 | Chonsurim IT worker Choe Song Won employed by a U.S. DeFi company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| since at least 2021 | Fraudulent identity documents for DPRK IT workers (The Solutions Tree; Syeda Aliya Batool Zaidi) | Pakistan | facilitators for DPRK IT workers |
| 2021-10-25T16:00:17+00:00 (blog summarizing MDDR 2021) | THALLIUM large-scale spear-phishing against government sector (MDDR 2021) | | THALLIUM |
| November 29, 2021 | SILENT CHOLLIMA intrusion against a pharmaceuticals organization (Export Control dropper) | | SILENT CHOLLIMA |
| 2021-08-24T15:43:30+00:00 (published_time) | InkySquid BLUELIGHT and RokRAT infection of an individual frequently targeted by North Korean actors | | InkySquid (ScarCruft/APT37) |
| 2021-12-16T10:00:19 | PseudoManuscrypt: a mass-scale spyware attack campaign | | |
| 2021-04-27 | APT trends report Q1 2021 (DPRK-related paragraph 1) | | |
| 2021-04-27 | APT trends report Q1 2021 (DPRK-related paragraph 2) | | |
| 2021-04-27 | APT trends report Q1 2021 (DPRK-related paragraph 3) | | |
| 2021-04-27 | APT trends report Q1 2021 (DPRK-related paragraph 4) | | |
| 2021-05-31 | IT threat evolution Q1 2021 (DPRK-related paragraph 1) | | |
| 2021-05-31 | IT threat evolution Q1 2021 (DPRK-related paragraph 2) | | |
| 2021-05-31 | IT threat evolution Q1 2021 (DPRK-related paragraph 3) | | |
| 2021-07-29 | APT trends report Q2 2021 (DPRK-related paragraph 1) | | |
| 2021-07-29 | APT trends report Q2 2021 (DPRK-related paragraph 2) | | |
| 2021-07-29 | APT trends report Q2 2021 (DPRK-related paragraph 3) | | |
| 2021-08-12 | IT threat evolution Q2 2021 (DPRK-related paragraph 1) | | |
| 2021-08-12 | IT threat evolution Q2 2021 (DPRK-related paragraph 2) | | |
| 2021-08-12 | IT threat evolution Q2 2021 (DPRK-related paragraph 3) | | |
| 2021-10-26 | APT trends report Q3 2021 (DPRK-related paragraph 1) | | |
| 2021-10-26 | APT trends report Q3 2021 (DPRK-related paragraph 2) | | |
| 2021-10-26 | APT trends report Q3 2021 (DPRK-related paragraph 3) | | |
| 2021-10-26 | APT trends report Q3 2021 (DPRK-related paragraph 4) | | |
| 2021-10-26 | APT trends report Q3 2021 (DPRK-related paragraph 5) | | |
| 2021-10-26 | APT trends report Q3 2021 (DPRK-related paragraph 6) | | |
| 2021-10-26 | APT trends report Q3 2021 (DPRK-related paragraph 7) | | |
| 2021/06/03 | ESET Threat Report T 1 2021 (DPRK-related paragraph 1) | | |
| 2021/06/03 | ESET Threat Report T 1 2021 (DPRK-related paragraph 2) | | |
| 2021/02/08 | (DPRK-related paragraph 1) | | |
| 2021-07-26T10:30:00.000Z | Kimsuky APT组织利用blogspot分发恶意载荷的攻击活动分析 | | |
| 2021-10-12T14:00:00.000Z | Kimsuky武器库更新：利用新冠疫情为诱饵针对韩国地区的攻击活动分析 | | |
| 2021-05-11T14:42:40.000Z | 疑似Lazarus组织利用大宇造船厂为相关诱饵的系列攻击活动分析 | | |
| 2021-12-30 | 【APT情报局】起底国家级APT组织——APT-C-26（Lazarus）（中） | | |
| 2021-12-20 | 【APT情报局】起底国家级APT组织——APT-C-26（Lazarus）（上） | | |
| 2021-04-19T22:00:00+00:00 | Lazarus APT conceals malicious code within BMP image to drop its RAT | South Korea | Lazarus APT |