| 2024-04 | Defense Contractors | Korea, Republic of | |
| 2023-03 | 3CX | United States | UNC4736 |
| 2022-11 | Deribit | Panama | Lazarus |
| 2022-11 | Massachusetts Defense Company | United States | Andariel |
| 2022-10 | Algorand | Singapore | Lazarus |
| 2022-09 | Gera Coin | United States | Lazarus |
| 2022-08 | Nomad Bridge | United States | |
| 2022-07 | H0lyGh0st Ransomware | United States | DEV-0530 |
| 2022-06 | Harmony Bridge | United States | |
| 2022-04 | Michigan Defense Company | United States | Andariel |
| 2022-04 | Randolph Air Force Base | United States | Andariel |
| 2022-04 | Robins Air Force Base | United States | Andariel |
| 2022-04 | Oregon Defense Company | United States | Andariel |
| 2022-03 | Axie Infinity | Viet Nam | |
| 2022-03 | DeFiance Capital | Singapore | |
| 2022-03 | Connecticut Healthcare Company | United States | Andariel |
| 2022-03 | Florida Hospital | United States | Andariel |
| 2022-03 | Colorado Medical Clinic | United States | Andariel |
| 2022-03 | California Defense Company | United States | Andariel |
| 2022-02 | NASA | United States | Andariel |
| 2022-01 | Qubit Finance | United Kingdom | |
| 2022-01 | Chinese Energy Company | China | Andariel |
| August 2023 | CSIS entry 201 | | |
| April 2022 | CSIS entry 353 | | |
| 2022-02 | On February 10, Threat Analysis Group discovered two distinct North Korean government-backed attacker groups exploiting a remote code execution vulnerability in Chrome, CVE-2022-0609. | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| February 2022 | CSIS entry 384 | | |
| 01.11.2022 | Presumed North Korean Threat Actors Have Been Targeting Personal Email Accounts of About 100 High-Ranking South Korean Military And State Officials Since November 2022 | Korea, Republic of;Korea, Republic of;Korea, Republic of | Unknown |
| 01.10.2022 | North Korean state-sponsored APT Andariel stole data from unnamed South Korean defence manufacturer through accessing maintenance/repair partner, starting in October 2022 | Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.11.2022 | North Korean state-sponsored APT Lazarus Group hacked into unnamed South Korean defence company and stole data starting in November 2022 | Korea, Republic of | Unknown |
| 22.12.2022 | State-sponsored North Korean hacker group Andariel stole sensitive information from South Korean defense companies as well as research institutes and pharmaceutical companies since at least 22 December 2022 | Korea, Republic of;Not available;Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.07.2022 | North Korean State-Sponsored Hacking Group Lazarus Compromised Unnamed Software Vendor Starting In Mid-2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2022 | North Korean state-sponsored hacking group 'Lazarus' gained access to network of unspecified Spanish aerospace company beginning in 2022 | Spain | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.11.2022 | North Korean state-sponsored APT groups 'Ruby Sleet' and 'Diamond Sleet' compromised two arms manufacturers in Germany and Israel beginning in November 2022 | Israel;Germany | Ruby Sleet fka CERIUM;Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.12.2022 | North Korean state-sponsored hacking group Kimsuky targeted the staff of consulting firm Korea Risk Group (KRG) and other organizations in the United States, Europe and Asia since December 2022 | Korea, Republic of;Asia (region);Asia (region);Europe (region);Europe (region);United States;United States | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 01.07.2022 | North Korean state-sponsored hacker group ScarCruft used RokRAT malware against unspecified Korean-speaking individuals beginning in July 2022 | Not available | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| 01.07.2022 | The North Korean state-sponsored hacking group Lazarus gained access into the networks of a defence contractor in Africa and stole data using the DeathNote malware beginning in July 2022 | Africa | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.06.2022 | North Korean state-sponsored hacking group UNC2970 targeted US and European media and technology companies since at least June 2022 | Europe (region);Europe (region);United States;United States | TEMP.Hermit/ UNC577 < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Lab 110) |
| 21.10.2022 | North Korean state-sponsored hacking group Lazarus gained access to two computers at a financial organisation beginning on 21 October 2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.05.2022 | North Korean state-sponsored hacking group Lazarus gained access to the network of a financial organisation in May 2022 | Not available | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| between May and November 2022 | “No Pineapple” campaign (Zimbra exploitation; 100 GB stolen) | | Lazarus Group |
| 02.09.2022 | Financially-motivated hacker group BlueNoroff compromised a company employee in the United Arab Emirates beginning in September 2022 | United Arab Emirates | Blue Noroff/APT38/Stardust Chollima/G0082/Sapphire Sleet fka COPERNICUM/Genie Spider < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2022-09-07T12:01:00.000Z | MagicRAT: Lazarus’ latest gateway into victim networks | | |
| 19 May 2022 | Lazarus Group Exploiting Log4Shell Vulnerability (NukeSped) - ASEC BLOG (ahnlab.com) | | Lazarus Group |
| 2022-11-15T10:00:28 | DTrack activity targeting Europe and Latin America | | |
| 2022-09-29T16:00:00+00:00 (published_time) | ZINC weaponizing open-source software (PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, muPDF/Subliminal Recording) via LinkedIn/WhatsApp | US, UK, India, and Russia | ZINC (now Diamond Sleet) |
| 2022-09-14 (datePublished) | UNC4034 job opportunity phishing via WhatsApp with trojanized PuTTY (AIRDRY.V2) at a media company | | UNC4034 (suspected North Korea nexus) |
| 01.02.2022 | Between February and July 2022, the North Korean group Lazarus targeted organizations, including energy service providers worldwide | Global (region);Canada;United States;Japan | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2022-04 | Operation “Covert Stalker” | | Kimsuky, Velvet Chollima |
| 2022-01 | North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-02 | Operation “LolZarus” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022 Early | Tracing State-Aligned Activity Targeting Journalists, Media | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-06 | ₿uyer ₿eware: Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-08 | deBridge Finance crypto platform targeted by Lazarus hackers | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-08 | Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-09 | SlowMist: Investigation of North Korean APT’s Large-Scale Phishing Attack on NFT Users | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022 Late | North Korean hackers linked to defense sector supply-chain attack | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2022-07 | Operation “STIFF#BIZON” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022-09 | Meeting the “Ministrer” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022-10 | Internet Explorer 0-day exploited by North Korean actor APT37 | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2022 Late | Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack | | Operation Earth Kitsune |
| 2022-12-27T08:00:26 | BlueNoroff introduces new methods bypassing MoTW | | |
| 2022-07-05 | Multiple organizations in Japan | Japan | NGB 3rd Technical Surveillance Bureau |
| 27 Apr 2022 | Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets | | |
| 2022-01-11 | MetaPlay ITW Theft | | |
| 2022-01-27 | ANKR founder | | |
| 2022-02-04 | DEPO ITW Theft | | |
| 2022-02-10 | Feb 10 2022 Theft | | |
| 2022-04-07 | Wonderhero | | |
| 2022-09-22 | DWF Labs | | |
| 2022-10-17 | Darshan | | |
| 2022-10-31 | Oct 31 2022 Theft | | |
| 2022-12-01 | Pixelcraft Potential IT Worker | | |
| 18/04/2022 | Organizations in the cryptocurrency and blockchain industries | US | Lazarus Group AKA APT38 |
| 2022-01-13T09:00:23 | The BlueNoroff cryptocurrency hunt is still on | | |
| Jul 2022 | Targeting of European Union (EU) member states | Czech Republic, Poland, and other EU countries | APT 37 |
| 数年来 (as of 2022) | Lazarus targeting of Japanese crypto-asset businesses for several years | Japan | ラザルス (北朝鮮当局の下部組織とされる) |
| Apr 2022 | Targeting of journalists reporting on North Korea | Journalists and the former director of South Korea’s National Intelligence Service | APT 37 |
| Jul 2022 | Targeting of South Korea with multiple spear-phishing campaigns | South Korean defense, education, medical, and energy companies and government agencies | Kimsuky |
| Aug 2022 | Targeting of South Korean diplomats, professors, and researchers | Six professors at different universities in South Korea, three think tank researchers, the former South Korean ambassador to the UN, a prominent diplomat in the South Korean government, and a representative on the Research Council for North Korea | Kimsuky |
| Feb 2022 | Targeting of the International Atomic Energy Agency and South Korean defense contractor | The International Atomic Energy Agency and Korea Aerospace Industries, a South Korean defense contractor | Kimsuky |
| 2022-12-01T15:41:19+00:00 (published_time) | Lazarus Group AppleJeus campaign via fake BloxHolder cryptocurrency trading website and malicious Office documents | | Lazarus Group |
| 31/03/2022 | Cryptocurrency users and investors. | >1 | Lazarus Group |
| 2022-12-26 | 기자·국회의원실등 사칭 전자우편 발송사건, 북 해킹조직 소행으로 확인 | | |
| February 2022 | Virtual token company based in Serbia (IT worker theft) | Serbia | Jong Pong Ju (alias "Bryan Cho"); Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, Chang Nam Il charged |
| In 2022 | Theft from Company 2, a blockchain research and development company headquartered in Atlanta, Georgia, by a remote developer | U.S. (Atlanta, Georgia) | Chang Nam Il, a North Korean citizen (Bong Chee Shen persona) |
| 2022-07-19 (press release date) | Justice Department Seizes and Forfeits Approximately $500,000 from North Korean Ransomware Actors and their Conspirators | | |
| (published July 7, 2022) | Lazarus YamaBot malware (Windows and Linux) attacks confirmed in Japan | Japan | Lazarus |
| active since 2022 (per Unit42) | Contagious Interview campaign (fake job interviews of IT engineers) | | FAMOUS CHOLLIMA (allegedly; unclear whether a Lazarus subgroup) |
| Im Jahr 2022 | North Korean cyber espionage via fake headhunters on online career networks against aerospace and propulsion companies | | Nordkoreanische Nachrichtendienste |
| (reporting period 2022-2023) | Kimsuky and Lazarus listed as APT threats to German targets (defence, law firms, aviation) | Germany | Kimsuky | VelvetChollima; Lazarus | SilentChollima |
| 2022-02-14 | 14th February– Threat Intelligence Report | | |
| May 6, 2022 | Blender.io used by DPRK to launder stolen virtual currency | | DPRK; "a DPRK state-sponsored hacking group" |
| 2022-07-09T17:00:00+00:00 | North Korean APT targets US healthcare sector with Maui ransomware | United States | State-sponsored North Korean threat actors |
| 2022-07-28T09:39:56+00:00 (published_time) | SharpTongue SHARPEXT mail-stealing browser extension incidents (since September 2021) | | SharpTongue (Kimsuky) |
| 2022-08-08 | 8th August – Threat Intelligence Report | | |
| 2022-08-08 | 8th August – Threat Intelligence Report | | |
| 2022-08-25T01:00:31 | Kimsuky’s GoldDragon cluster and its C2 operations | | |
| 2022-10-03 | 3rd October – Threat Intelligence Report | | |
| May 10 2022 (dateCreated 2022-05-10) | Mac Protection: New macOS malware 'NukeSped' detected and protected against | | Lazarus Group |
| (seizures March, June, August and September 2022) | North Korean IT worker money laundering network: IT worker payments laundered and sent back via Sim Hyon Sop (FTB) and Kim Sang Man (Chinyong / Jinyong IT Cooperation Company) | | North Korean IT workers; Sim Hyon Sop; Kim Sang Man; Chinyong (Jinyong IT Cooperation Company) |
| In or around February 2022 to on or about March 17, 2023 | U.S. Business #2, a talent hiring firm located in Texas: IT worker under M.H. identity; extortion and leak | U.S. (Texas) | HYON CHOL SONG |
| Over a roughly three-year period (hosting laptops since at least 2022; searches October 10, 2024) | Zhenxing Wang / Kejia Wang New Jersey laptop farms supporting North Korean IT workers at more than 100 U.S. companies | U.S. (New Jersey) | North Korean IT workers; Zhenxing Wang; Kejia Wang |
| since the release of the 2022 advisories | DPRK IT worker scheme (updated tradecraft) | | DPRK IT workers |
| 2022 | Tornado Cash laundering of Lazarus heist proceeds (largest known heist) | | Lazarus Group |
| June 24, 2022; August 2, 2022 | Harmony Bridge Heist and Nomad Heist proceeds laundered via Tornado Cash (release does not attribute these two to DPRK) | | "malicious cyber actors" (not attributed in this sentence) |
| 2022 | DPRK virtual currency theft total for 2022 (public reporting) | | DPRK cyber actors |
| 2022 | DPRK virtual currency theft in 2022 (UN Panel of Experts estimate) | | DPRK cyber actors |
| Between early 2022 and approximately September 2023 | UAE-based laundering of IT-worker and cybercrime proceeds (Lu Huaying, Zhang Jian, Green Alpine Trading) | United Arab Emirates | Sim Hyon Sop network |
| since at least 2022; Since at least 2021 | IT worker delegations in Laos (Korea Osong Shipping Co; Chonsurim Trading Corporation; Department 53) | Laos | Department 53 of the Ministry of the People's Armed Forces |
| In 2022 and 2023 | Song Kum Hyok IT worker scheme using U.S. persons' identities | United States | Song Kum Hyok (Andariel) |
| In April and May 2022 | Lazarus Group laundering of hacking proceeds through Tornado Cash | | Lazarus Group |
| (2022) | Ronin hack proceeds transmitted through Tornado Cash | | Lazarus Group |
| May 16, 2022 | DPRK IT workers dispatched worldwide (PRC and Russia primarily) | | DPRK IT workers |
| 16/05/2022 | Multiple organizations worldwide | >1 | Democratic People’s Republic of Korea (DPRK) |
| end of 2022 | Supply-chain intrusion into a maritime/shipping technology research center via its web maintenance company | | "a North Korean cyber actor" |
| 08/02/2022 | Organizations in South Korea | KR | Kimsuky AKA TA406 |
| 2022-03-24T16:00:00+00:00 (datePublished) | Operation AppleJeus exploiting Chrome CVE-2022-0609 (compromised fintech websites) | U.S. based | North Korean group (Operation AppleJeus) |
| 2022-04-26 | Lazarus Group APT Targeting South Korean Users | Zscaler | | |
| 04/08/2022 | Employees in the fintech industry | >1 | Lazarus Group |
| 2022/09/30 | Amazon-themed campaigns of Lazarus in the Netherlands and Belgium | | |
| 2022-10-24 | Unveil the evolution of Kimsuky targeting Android devices with newly discovered mobile malware | | Kimsuky |
| 2022/11/30 | Who’s swimming in South Korean waters? Meet ScarCruft’s Dolphin | | |
| 12/12/2022 | Foreign experts about North Korea | >1 | Kimsuky AKA Thallium |
| 2022년 상반기 | North Korea-linked phishing of foreign-policy, security and defense experts (Feb 2022: fake military research and peace association) | | |
| 2022년 상반기 | Phishing emails impersonating the Ministry of Unification (May 2022); KTV broadcast-invitation lure | | |
| 2022년 상반기 | ESRC column: recent Kimsuky payload changes (Daum mail used for command and control) | | |
| 2022년 상반기 | ESRC column: Kimsuky (Thallium) phishing domains impersonating portal sites | | |
| 2022년 하반기 | KISA crypto-incident timeline entries naming Lazarus (June to August 2022) | | |
| 2022년 하반기 | Lazarus laundering of Eterbase theft; Elliptic attributes Harmony Horizon bridge theft to Lazarus | | |
| 2022년 하반기 | Malicious crypto-stealing apps similar to those used by Konni in 2019 | | |
| 2022년 하반기 | North Korea placing IT workers at tech companies worldwide (CNN); US State Department $10 million reward | | |
| 2022년 하반기 | Malicious Hangul documents about the 20th presidential election, attributed to North Korean hackers | | |
| 2022년 하반기 | Lazarus impersonating executives of Japanese companies to phish employees | | |
| 2022-12-07 | 오퍼레이션 이블플레인(Operation EvilPlane) : 국내 이용자의 개인정보가 담긴 파일을 이용한 APT 공격 | | KONNI; Konni; 북한 정찰총국; 정찰총국; 코니 |
| 2022-10-21 | Trojan.Android.AgentNK 악성코드 분석 보고서 | | KONNI; Konni; 김수키; 코니 |
| 2022-09-28 | 암호화폐 기업 제휴 이슈로 가장한 코니(Konni) 해킹 위협 주의! | | KONNI; Konni; 북한 정찰총국; 정찰총국; 코니 |
| 2022-08-26 | 김수키(Kimsuky) 그룹, 러시아 외무부를 타겟으로 공격 진행중! | | Kimsuky; 김수키 |
| 2022-08-25 | 北 해킹 조직, 한미연합훈련 기간 중 방위산업체 대상 공격 | | Kimsuky; Thallium; 김수키; 북한 정찰총국; 블루 에스티메이트; 정찰총국; 탈륨 |
| 2022-08-17 | 현직 경찰 공무원 신분증을 도용한 북한발 해킹 공격 주의! | | 북한 정찰총국; 스모크 스크린; 정찰총국 |
| 2022-08-08 | 북한 해커 조직, 국내 대형 포털 클라우드 서비스 사칭하여 공격 중! | | 북한 정찰총국; 정찰총국 |
| 2022-07-29 | 北 해킹 조직, 韓 국방·안보 전문가를 노린 APT 공격 수행 | | Fake Striker; 북한 정찰총국; 정찰총국; 페이크 스트라이커 |
| 2022-07-25 | 외화벌이를 목적으로 하는 北 배후의 써미츠 NFT 보상 사칭 해킹 주의! | | |
| 2022-06-15 | 6·15 남북공동선언기념 통일정책포럼 발제문으로 위장한 北 연계 해킹 주의 | | 페이크 스트라이커 |
| 2022-05-23 | 문체부 산하 KTV 유튜브채널 방송 섭외로 둔갑한 북한 소행 해킹 공격 주의! | | 금성121 |
| 2022-05-09 | 북한이탈주민(탈북민) 자문위원대상 의견수렴 설문지 위장 北 연계 해킹 주의! | | |
| 2022-12-02 | 외교안보 학술회의 토론 주제 사칭한 北 연계 해킹 공격 주의! | | |
| 2022-10-26 | 국립외교원 구글 설문지로 위장한 北 연계 해킹 공격 등장! | | Fake Striker; 북한 정찰총국; 정찰총국; 페이크 스트라이커 |
| 2022-10-12 | 논문 심사 사례비 지급으로 위장한 북한發 해킹 공격 주의 | | Fake Striker; 북한 정찰총국; 정찰총국; 페이크 스트라이커 |
| 2022-08-22 | 북 해킹 조직, 국내 유명 모바일 메신저를 통해 공격 진행 중! | | |
| 2022-02-16 | 디지털 자산 지갑 서비스 고객센터로 위장한 北 연계 APT 공격 발견! | | Kimsuky; 스모크 스크린; 탈륨 |
| 2022-01-28 | 북한 연계 해킹조직 코로나19 백신접종 전자문서 사칭으로 공격중 | | |
| 2022-01-26 | 국제 행사 동시 통역사를 겨냥한 北 연계 해킹 시도 등장 | | |
| 2022-06-29 | 국회입법조사처 사칭하여 '국방·외교·안보'분야 교수 해킹을 시도하는 北 연계 해킹공격 주의! | | |
| 2022-04-01 | 대한임상건강증진학회 코로나19 백신 알림으로 사칭한 北연계 해킹 공격 주의! | | |
| 2022-03-18 | 통일부 남북관계 주요일지로 위장한 北 공격 주의! | | |
| 2022-03-04 | 병·의료원 건강검진 증명서 발급으로 위장한 北 연계 공격 등장 | | |
| 2022-02-23 | 외교 안보 국방분야 대상, 北 연계 해킹 공격 주의보 | | |
| 2022-01-13 | 금융社 또는 북한 내부 정보로 현혹하는 北 배후 해킹 증가 주의 | | |
| 2022-12-20 | 연말 외교·안보 종사자 대상 자료요청, 알고 보니 北 연루 해킹 위협 | | Smoke Screen; 스모크 스크린 |
| 2022-02-03 | 악성 워드 문서 유포를 통한 APT 공격 시도 (External 연결 + VBA 매크로) | | Kimsuky |
| 2022-02-14 | 대북관련 원고 요구사항을 가장한 APT 공격시도 (Kimsuky) | | Kimsuky |
| 2022-03-18 | 탄소배출 전문기업 타겟 워드문서 공격 | | Kimsuky |
| 2022-03-22 | 코인관련 내용의 워드문서를 이용한 APT 공격 (Kimsuky) | | Kimsuky |
| 2022-03-23 | PDF 문서로 위장하여 유포되는 VBS 스크립트 (Kimsuky) | | Kimsuky |
| 2022-03-29 | 울진 산불 피해 기부 영수증으로 위장한 워드 문서 APT 공격 (Kimsuky) | | Kimsuky |
| 2022-04-18 | INITECH 프로세스에 인젝션돼 동작하는 라자루스 공격 그룹의 신종 악성코드 | | Lazarus; 라자루스 |
| 2022-04-27 | 대북 관련 파일명을 지닌 악성 워드 문서 유포 중 | | Kimsuky |
| 2022-05-12 | 악성코드 감염 시 단순히 치료에 그쳐서는 안되는 이유 | | |
| 2022-05-18 | 다양한 주제의 보도자료를 사칭한 Kimsuky 공격시도 | | Kimsuky |
| 2022-05-31 | 인터넷 공유기 설치파일 위장한 AppleSeed 유포 | | Kimsuky |
| 2022-06-10 | 활발하게 유포 중인 BAT 스크립트 포함한 악성 한글문서 (북한/국방/방송) | | Kimsuky |
| 2022-06-30 | 발주서, 품의서를 위장한 AppleSeed 유포 | | Kimsuky |
| 2022-07-21 | 특정 군부대 유지보수 업체 대상으로 AppleSeed 유포 | | Kimsuky |
| 2022-07-26 | 공격자 메일에 회신한 경우에 외부 링크로 제공되는 워드문서 (Kimsuky) | | Kimsuky |
| 2022-08-19 | 대북 관련 특정인을 타겟으로 하는 악성 워드 문서 | | Kimsuky |
| 2022-09-22 | 라자루스 그룹의 BYOVD를 활용한 루트킷 악성코드 분석 보고서 | | 라자루스 |
| 2022-10-06 | 라자루스 그룹 DLL Side-Loading 기법 이용 (mi.dll) | | 라자루스 |
| 2022-10-24 | BYOVD 기법으로 백신 프로그램을 무력화하는 라자루스 공격 그룹의 악성코드 감염 사례 | | Lazarus; 라자루스 |
| 2022-10-27 | 원자력 발전소 관련 기업 대상으로 AppleSeed 유포 | | Kimsuky |
| 2022-11-17 | MS Office 정상 URL 위장하여 유포중인 워드문서 | | Kimsuky |
| 2022-12-14 | 국내 유명 금융 앱 사칭한 피싱공격 | | Kimsuky |
| 2022-12-08 | 북한 IT 인력에 대한 정부 합동주의보 발표 | | 북한 IT 인력 |
| 2022-12-08 | 북한 정보기술(IT) 인력에 대한 정부 합동주의보 발표 | | 북한 IT 인력 |
| 2022-08-30 | APT-C-26（Lazarus）组织伪造电商组件攻击活动分析报告 | | Lazarus; APT-C-26 |
| 2022-10-24 | 日本を付け狙う北朝鮮の脅威アクター「ラザルス」、その攻撃手法と次の標的 | | Lazarus; ラザルス |
| 2022-05-06 | “북 해킹조직, SNS서 미 군수업체 사칭 지속” | | 라자루스 |
| 2022-11-08 | 북 ‘라자루스’, 이스라엘 암호화폐 업체 해킹시도 | | 라자루스 |
| June 2022 | Targeting of a governmental entity in Ukraine | Ukraine | Lazarus |
| late December 2022 | TA444 credential-harvesting phishing (“SendGrid URL”) | multiple Member States | TA444 (“overlaps with BlueNoroff”) |
| 2022 | Backdoor and data theft (satellite component blueprints) at Sputnix OOO | Russian Federation | Democratic People’s Republic of Korea hackers |
| 2022-12-06T17:00:00+00:00 (published_time) | DEV-0139 targeted attacks against the cryptocurrency industry via Telegram chat groups | | DEV-0139 (now Citrine Sleet) |
| since at least December 2022 (identified November 2023) | Contagious Interview campaign (BeaverTail, InvisibleFerret) | | DPRK cyber actors |
| August 2022 | Choe Song Won employed by a second U.S. DeFi company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| July to December 2022 | Chonsurim IT workers employed by a U.S. NFT start-up (one as senior leader) | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| August 2022 to July 2023 | Chonsurim IT worker (Ukrainian identity) employed by a European manufacturing company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| 2022-11-10T17:00:00+00:00 (published_time) | ZINC weaponizing open-source software (CyberWarCon 2022 talk) | 34 countries | ZINC (now Diamond Sleet) |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | CERIUM and ZINC targeting defense and aerospace companies (fake recruiter LinkedIn profiles) | around the globe | CERIUM; ZINC |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | CERIUM probing South Korean VPNs and targeting the South Korean military | South Korean | CERIUM |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | COPERNICIUM targeting cryptocurrency-related companies, including in China and Hong Kong | around the world; China, both on the mainland and in Hong Kong | COPERNICIUM |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | DEV-0215 targeting media organizations that follow North Korean news and Korean-speaking Christian communities | | DEV-0215 |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | OSMIUM interest in international aid organizations | | OSMIUM |
| Microsoft Digital Defense Report 2022 (covers July 1, 2021 to June 30, 2022) | North Korean targeting of Russian think tanks, academics, and diplomatic officials | Russian | North Korean threat actors |
| 2022-03-23 (datePublished) | Bureau 325 COVID-19-focused targeting shifting to defectors, defense, governments, media, cryptocurrency services and financial institutions | | Bureau 325 (assessed) |
| 2022-05-27T08:00:43 | IT threat evolution Q1 2022 | | |
| 2022-03-31T12:00:23 | Lazarus Trojanized DeFi app for delivering malware | | |
| 2022-08-09T10:00:46 | Andariel deploys DTrack and Maui ransomware | | |
| 2022-04-27 | APT trends report Q1 2022 (DPRK-related paragraph 1) | | |
| 2022-04-27 | APT trends report Q1 2022 (DPRK-related paragraph 2) | | |
| 2022-04-27 | APT trends report Q1 2022 (DPRK-related paragraph 3) | | |
| 2022-05-27 | Kaspersky IT threat report for Q1 2022 (DPRK-related paragraph 1) | | |
| 2022-05-27 | Kaspersky IT threat report for Q1 2022 (DPRK-related paragraph 2) | | |
| 2022-05-27 | Kaspersky IT threat report for Q1 2022 (DPRK-related paragraph 3) | | |
| 2022-07-28 | APT trends report Q2 2022 (DPRK-related paragraph 1) | | |
| 2022-07-28 | APT trends report Q2 2022 (DPRK-related paragraph 2) | | |
| 2022-07-28 | APT trends report Q2 2022 (DPRK-related paragraph 3) | | |
| 2022-08-15 | Non-mobile malware statistics, Q2 2022 (DPRK-related paragraph 1) | | |
| 2022-11-01 | APT trends report Q3 2022 (DPRK-related paragraph 1) | | |
| 2022-11-01 | APT trends report Q3 2022 (DPRK-related paragraph 2) | | |
| 2022-11-01 | APT trends report Q3 2022 (DPRK-related paragraph 3) | | |
| 2022-11-01 | APT trends report Q3 2022 (DPRK-related paragraph 4) | | |
| 2022-11-01 | APT trends report Q3 2022 (DPRK-related paragraph 5) | | |
| 2022-11-01 | APT trends report Q3 2022 (DPRK-related paragraph 6) | | |
| 2022-11-18 | PC malware statistics, Q3 2022 (DPRK-related paragraph 1) | | |
| 2022-11-18 | PC malware statistics, Q3 2022 (DPRK-related paragraph 2) | | |
| 2022-11-18 | PC malware statistics, Q3 2022 (DPRK-related paragraph 3) | | |
| 2022-11-18 | IT threat evolution Q3 2022 (DPRK-related paragraph 1) | | |
| 2022-11-18 | IT threat evolution Q3 2022 (DPRK-related paragraph 2) | | |
| 2022-11-18 | IT threat evolution Q3 2022 (DPRK-related paragraph 3) | | |
| 2022-11-18 | IT threat evolution Q3 2022 (DPRK-related paragraph 4) | | |
| 2022-11-18 | IT threat evolution Q3 2022 (DPRK-related paragraph 5) | | |
| 2022-11-18 | IT threat evolution Q3 2022 (DPRK-related paragraph 6) | | |
| Tue, 12 Apr 2022 09:02:11 +0000 | APT Group Lazarus Distributing Korean Phishing Lures to Feel Out Cryptocurrency Users | | |
| 2022-12-01T06:00:00.000Z | ZetaNile: Open source software trojans from North Korea | RL Blog | | |
| 2022-12-05T15:50:00.000Z | 来自Kimsuky组织的突刺：多种攻击武器针对韩国的定向猎杀 | | |
| 2022-07-25T10:23:26.000Z | 钓鱼之王 —— Kimsuky近期以多个话题针对韩国的鱼叉式钓鱼攻击活动分析 | | |
| 2022-12-23T14:04:55.000Z | 求职陷阱：Lazarus组织以日本瑞穗銀行等招聘信息为诱饵的攻击活动分析 | | |
| 2022-05-06T10:09:14.000Z | 雪虐风饕：疑似Lazarus组织针对韩国企业的攻击活动分析 | | |
| 2022/11/14 | ESET APT Activity Report T2 2022 (DPRK-related paragraph 1) | | |
| 2022/11/14 | ESET APT Activity Report T2 2022 (DPRK-related paragraph 2) | | |
| 2022/10/05 | ESET Threat Report T2 2022 (DPRK-related paragraph 1) | | |
| 2022/10/05 | ESET Threat Report T2 2022 (DPRK-related paragraph 2) | | |
| 2022-01-25 | 【APT情报局】起底国家级APT组织——APT-C-26（Lazarus）（下） | | |
| 2022-08-09T05:00:00.000Z | GwisinLocker ransomware targets South Korean industrial and pharma firms | South Korea | Gwisin group (speculated North Korea based) |
| 2022-03-01T00:00:00.000Z | Targeted APT Activity: BABYSHARK Is Out for Blood | | DPRK state-sponsored threat actor |
| 2022-01-25T17:00:00+00:00 | KONNI evolves into stealthier RAT | Russia; South Korea | Kimsuky umbrella (KONNI) |
| 2022-12-16T00:00:00.000Z | Discover Activities Linked to the DPRK-nexus Intrusion Sets (2022 review: AppleJeus, SnatchCrypto, DreamJob) | | Kimsuky; Lazarus; Bluenoroff; Andariel |