2023 (358)

Date (as written)	Incident	Country	Actors
2023-12	Orbit Bridge	Korea, Republic of
2023-12	OKX DEX	Seychelles	Lazarus
2023-11	CyberLink	Taiwan	Diamond Sleet
2023-11	HECO Bridge	Singapore	Lazarus
2023-11	HTX	Seychelles	Lazarus
2023-11	UnoRe DAO	Estonia
2023-11	Poloniex	United States	Lazarus
2023-10	Maverick Founder	Singapore	Lazarus
2023-10	Fantom Foundation	Cayman Islands
2023-09	Mixin Network	Hong Kong
2023-09	CoinEx	United States	Lazarus
2023-09	Stake.com	Australia	Lazarus
2023-08	Coinshfit	United States	Lazarus
2023-08	Steadefi	Virgin Islands, British	Lazarus
2023-07	Alphapo	Saint Vincent and the Grenadines	Lazarus
2023-07	CoinsPaid	Estonia	Lazarus
2023-06	JumpCloud	United States	UNC4899
2023-06	Atomic Wallet	Estonia	Lazarus
2023-04	Merlin DEX	United Kingdom
2023-04	Terraport Finance	United Kingdom, 🇰🇷 Korea, Republic of
2023-03	MagicLine	Korea, Republic of	Lazarus
2023-03	South Korean Manufacturing Company	Korea, Republic of	Andariel
2023-01	Taiwanese Defense Company	Taiwan	Andariel
October 2023	CSIS entry 165
August 2023	CSIS entry 190
June 2023	CSIS entry 219
April 2023	CSIS entry 237
2023-04-05T12:00:00+00:00 (datePublished)	ARCHIPELAGO (subset of APT43) phishing of North Korea policy experts	South Korea, the US and elsewhere	ARCHIPELAGO (subset of APT43)
March 2023	CSIS entry 246
02/02/2023	Organizations in medical research, healthcare, chemical engineering, energy, defense, and a leading research university	>1	Lazarus Group
01.12.2023	The North Korean state-aligned hacking group Moonstone Sleet compromised a defence technology company and stole credentials as well as intellectual property in early December 2023	Not available	Moonstone Sleet / Storm-1789
01.04.2023	North Korean state-sponsored APT Kimsuky stole technical data from unnamed South Korean defence company via email hack from April to July 2023	Korea, Republic of	Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094
01.12.2023	North Korean threat groups compromised South Korean Semiconductor companies in late 2023 and early 2024	Korea, Republic of	Unknown
01.08.2023	North Korean State-Sponsored Hacker Group Lazarus Exploited Windows Zero-Day Vulnerability in Admin-to-Kernel Operation going back to at least August 2023	Asia (region);Not available	Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
01.01.2023	North Korean hackers infiltrated email account of staff member of Office of South Korean President	Korea, Republic of	Unknown
2023-12-11T13:50:59.000Z	Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang
2023-11	Kimsuky Targets South Korean Research Institutes with Fake Import Declaration		Kimsuky, Velvet Chollima
2023-08-22	Andariel 그룹의 새로운 공격 활동 분석		Andariel; Kimsuky; Lazarus
01.10.2023	North Korean state-sponsored hacking group Diamond Sleet compromised vulnerable TeamCity servers since early October 2023	Not available	Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
01.01.2023	North Korean state-sponsored APT group 'Diamond Sleet' compromised defence companies in several countries in January 2023	Norway;Finland;Italy;Brazil;Poland;Czech Republic	Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
01.03.2023	North Korean APT group 'Onyx Sleet' targeted Russian University in March 2023	Russia;Russia	Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
01.03.2023	North-Korean APT group 'Ruby Sleet' targeted Russian aerospace research institute in March 2023	Russia	Ruby Sleet fka CERIUM
01.01.2023	North Korean state-sponsored hacking group Labyrinth Chollima gained access to network of unnamed Latin American banking company using QRLOG malware beginning in January 2023	South America;Central America (region)	Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
2023-08-24T12:04:22.000Z	Lazarus Group's infrastructure reuse leads to discovery of new malware
2023-07	Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points		Lazarus Group, Hidden Cobra, Labyrinth Chollima
2023-06-28T10:00:24	Andariel’s silly mistakes and a new malware family
01.05.2023	North Korean state-sponsored hacking group Kimsuky stole documents from unspecified victims in May 2023	Not available	Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094
21/06/2023	Multiple organizations	N/A	APT37 (AKA StarCruft, Reaper, or RedEyes)
Not available	Lazarus Group targeted Windows IIS Web Servers in Global Campaign	Not available	Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110)
over the last couple of years (as of 20 March 2023)	Kimsuky spear phishing against Korean and German entities	South Korea; Germany	KIMSUKY (Thallium, Velvet Chollima)
01.01.2023	APT37 uses M2RAT backdoor for intelligence collection purposes on unspecified individuals since 2023	Not available	APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067
February 09, 2023	DPRK ransomware attacks on Healthcare and Public Health and other critical infrastructure		DPRK cyber actors
2023-03	North Korean APT group ‘Kimsuky’ targeting experts with new spearphishing campaign		Kimsuky, Velvet Chollima
2023-05	Kimsuky Group Using Meterpreter to Attack Web Servers		Kimsuky, Velvet Chollima
2023-05	Kimsuky Group’s Phishing Attacks Targetting North Korea-Related Personnel		Kimsuky, Velvet Chollima
2023-11	SmallTiger Malware Used in Attacks Against South Korean Businesses (Kimsuky and Andariel)		Kimsuky, Velvet Chollima
2023-06	Lazarus Threat Group Exploiting Vulnerability of Korean Finance Security Solution		Lazarus Group, Hidden Cobra, Labyrinth Chollima
2023-07-18T14:43:24+00:00	Security alert: social engineering campaign targets technology industry employees		Jade Sleet; TraderTraitor
27/10/2023	Undisclosed software vendor	N/A	Lazarus (aka Diamond Sleet and ZINC)
2023-10	Operation “Dream Magic”		Lazarus Group, Hidden Cobra, Labyrinth Chollima
2023-10	Elastic catches DPRK passing out KANDYKORN		Lazarus Group, Hidden Cobra, Labyrinth Chollima
2023-04	ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK)		Reaper, APT 37, Ricochet Chollima, ScarCruft
2023-07	Operation “STARK#MULE”		Reaper, APT 37, Ricochet Chollima, ScarCruft
2023-12	ScarCruft \| Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals		Reaper, APT 37, Ricochet Chollima, ScarCruft
2023-01-01	Various 2023 Rug Pulls
2023-06-11	A Large Theft / Investment Platform
2023-07-01	PolyNetwork
2023-08-17	SPooCK
2023-09-28	Unidentified Company
2023-10-05	Blockbusters Tech
2023-11-07	NFT Phishing
2023-11-10	Samudai
2023-11-10	Waygate
2023-11-19	Kronos
2023-12-10	Degen Reborn
2023-12-28	Upwork Developer Jobs Scams
2023-05-04T13:55:19.000Z	Kimsuky Evolves Reconnaissance Capabilities in New Global Campaign \| SentinelOne
May 2023	Targeting of cryptocurrency exchanges in DangerousPassword campaign	Cryptocurrency exchanges in Japan and other countries	Lazarus Group
2023-11-10	자산 관리 프로그램을 악용한 공격 정황 포착 (Andariel 그룹)		Andariel; Kimsuky; Lazarus
Nov 2023	Targeting of Danish critical infrastructure companies	Users of CyberLink’s Promeo software	Sandworm
Apr 2023	Targeting of human rights groups and activists related to human rights advocacy in North Korea	Human rights groups and activists focused on North Korea	Believed to be the work of the North Korean government
April 21 2023 (dateCreated 2023-04-21)	'RustBucket' malware targets macOS		BlueNoroff (sub-group of Lazarus Group)
Aug 2023	Targeting of South Korean defense industry and an electronics manufacturer	South Korean defense conglomerates, universities, and electronics manufacturers	Lazarus Group
Apr 2023	Targeting of South Korean institutions	South Korean education, construction, diplomatic, and political institutions	Tonto Team
2023-01-13	김수키(Kimsuky)조직, 카카오 피싱 공격 진행 중		Kimsuky; 김수키; 북한 정찰총국; 정찰총국
14/06/2023	South Korea	KR	North Korea
16 August 2023	[unidentified company]	unidentified	Suspected DPRK (annex title)
09/14/2023	Remitano - REKT
2023-10-18 (press release date)	Justice Department Announces Court-Authorized Action to Disrupt Illicit Revenue Generation Efforts of Democratic People’s Republic of Korea Information Technology Workers
(published 23 November 2023)	DPRK state-linked software supply chain attacks using zero-day vulnerabilities (NCSC-NIS joint advisory)		DPRK state-linked cyber actors
Im Jahr 2023	Cyber espionage against aerospace and propulsion technology companies via social engineering (RGB, probably responsible for Lazarus attacks)		Reconnaissance General Bureau (RGB), wahrscheinlich verantwortlich für Lazarus
(reporting period 2023-2024)	Lazarus job-offer document attacks on German IT services, weapons/ammunition and aerospace sectors	Germany	Labyrinth Chollima / Lazarus / Diamond Sleet
(reporting period 2023-2024)	Kimsuky social engineering against German research, public administration, legal advice and education sectors	Germany	APT43 / Velvet Chollima / Kimsuky / Emerald Sleet
En juin 2023	Kimsuky spear-phishing of a senior executive of a French strategic-affairs think tank	France	MOA réputé lié aux intérêts nord-coréens Kimsuky
2023-01-02	2nd January – Threat Intelligence Report
2023-03-21	APT37 \| ThreatLabz
2023-03-30T11:37:54+00:00 (published_time)	3CX Desktop App supply chain compromise (ICONIC)		UTA0040, later attributed to Lazarus
2023-05-01	Chain Reaction: ROKRAT’s Missing Link
10/05/2023	Seoul National University Hospital (SNUH)	KR	North Korean threat actor (Kimsuky)
2023-05-23T11:23:42.000Z	Kimsuky \| Ongoing Campaign Using Tailored Reconnaissance Toolkit \| SentinelOne
June 1, 2023	Impersonation of South Korean think tank researchers	South Korea	Kimsuky (Thallium, APT43, Velvet Chollima, Black Banshee)
2023-07-03	3rd July – Threat Intelligence Report
07/08/2023	NPO Mashinostroyeniya	RU	ScarCruft
29/09/2023	Undisclosed Spanish aerospace company	ES	Lazarus Group (AKA HIDDEN COBRA)
6 November 2023	“BlueNoroff strikes again with new macOS malware,” Jamf Threat Labs		BlueNoroff
September 27 2023	macOS Threat Hunting: Unraveling RustBucket Malware Tactics (JNUC talk)		Lazarus APT group; BlueNoroff
November 2023	Theft of approximately $138 million from a Panama-based virtual currency exchange	Panama	APT38
2023	Data exfiltrated from "South Korean Defense Company 1"	South Korea	RIM JONG HYOK and Conspirators; RGB cyber unit known as Andariel, Onyx Sleet, and Silent Chollima
2023	Data exfiltrated from "South Korean Defense Company 2"	South Korea	RIM JONG HYOK and Conspirators; RGB cyber unit known as Andariel, Onyx Sleet, and Silent Chollima
JAN 19 2023 (application)	Seizure of approximately $397,674.32 in 35 money-transfer accounts holding proceeds of North Korean IT worker fraud scheme (Yanbian Silverstar)	China (withdrawals to bank accounts in China)	North Korean IT workers; Yanbian Silverstar
Between on or about January 21, 2023, and on or about May 6, 2024	Overseas IT worker posing as "Thomas H." employed at Company A, a California-based software development firm	U.S. (California)	overseas co-conspirator; Kejia Wang; Zhenxing Wang
on or about September 19, 2023	Didenko-linked laptop farm at Virginia Beach, VA hosting laptops for remote IT workers (UpWorkSell; approximately 871 proxy identities)	U.S. (Virginia Beach, Virginia)	DIDENKO and customers (overseas remote IT workers; affidavit cites "North Korean programmers" tip)
July 2023	Circle access denial on three wallet addresses linked to exploit of a cross-chain bridge		(complaint context: North Korea-affiliated laundering via USDC)
May 9, 2023 (as shown on page; incident March 2022)	Ronin Network (Axie Infinity) bridge theft		Lazarus Group (OFAC listing, April 14th)
May 9, 2023 (as shown on page; incident June 2022)	Harmony Horizon Bridge exploit		Lazarus Group (FBI-confirmed)
published 2023-05-03 (2022 hack)	Qubit QBridge hack	South Korea	North Korea-linked hackers (likely)
starting June 3rd (2023)	'Dark 101 Days': 5 platforms compromised, mostly centralized service platforms		the North Korean hacker group Lazarus Group
published 2023-09-13	3CX software supply chain attack and JumpCloud data breach (June 2023)		likely orchestrated by North Korean hackers (Mandiant); JumpCloud traced to Lazarus subgroup Labyrinth Chollima
2023-04-24	IT workers at U.S. blockchain development companies laundering earnings via Sim	United States	Sim Hyon Sop; North Korean IT workers
January 13, 2023	Laundering of Harmony proceeds via RAILGUN		North Korean cyber actors
2023-08-22	Approximately 1,580 bitcoin from several heists held for cash-out		TraderTraitor (Lazarus Group, APT38)
on or about July 22, 2023; on or about June 2, 2023	2023 thefts: Alphapo/CoinsPaid and Atomic Wallet (DPRK total more than $200 million in 2023)		DPRK cyber actors
Between mid-2023 and mid-2025	Crypto conversion of Amnokgang IT worker earnings		Amnokgang Technology Development Company
Since at least 2023	IT worker group operating out of Boten, Laos	Laos	Yun Song Guk
2023-04-24	Laundering of stolen funds from virtual currency exchange hacks via OTC traders		Sim Hyon Sop; Wu Huihui; Cheng Hung Man; "Jammy Chen"
Nov. 29, 2023	Sinbad.io used by a DPRK state-sponsored hacking group		DPRK; "a DPRK state-sponsored hacking group"
publication date not shown on page (covers activity since June 2023)	Jade Sleet theft from an Estonia-based cryptocurrency firm (early June 2023)	Estonia	Jade Sleet
July 2023	Theft of approximately $100 million from a Panama-based virtual currency payment processor	Panama	APT38
November 2023	Theft of approximately $107 million from a Seychelles-based virtual currency exchange	Seychelles	APT38
25/01/2023	Crypto users	ES JP PL UK US	TA444
2023-02-14	스테가노그래피 기법 사용한 한글(HWP) 악성코드 : RedEyes(ScarCruft)		APT37; RedEyes; ScarCruft
2023-02-15	Distribution of Malware Exploiting Vulnerable Innorix: Andariel		Andariel
2023-03-09 (datePublished)	UNC2970 job-recruitment phishing against Western media and technology companies (since June 2022)	U.S.-based; U.S. and European	UNC2970 (suspected UNC577 / Temp.Hermit)
2023-03-28 (datePublished)	APT43 espionage and cryptocurrency theft to fund operations	South Korea, Japan, Europe, and the United States	APT43 (Kimsuky)
2023-04-12T08:00:00	Following the Lazarus group by tracking DeathNote campaign
20/04/2023	People working in software or DeFi platforms	>1	Lazarus Group AKA Labyrinth Collima, Covellite, UNC4034, Zinc, Nickel Academy)
06/06/2023	Financial institutions and venture capital firms in Japan, Vietnam, and the United States	JP US VN	TAG-71 (APT38)
29/06/2023	Multiple organizations	>1	BlueNoroff (part of the Lazarus Group)
2023-07-27T05:00:00.000Z	More malicious npm packages found in wake of JumpCloud supply chain hack		North Korea; Lazarus Group
03/08/2023	IT Professionals	>1	Lazarus Group
2023-08-12T22:25:00+00:00	Sophisticated, Highly-Targeted Attacks Continue to Plague npm (campaign with behaviors similar to June North Korean campaign)		North Korean state actors (June campaign)
2023-09-07T15:00:00+00:00 (datePublished)	New campaign targeting security researchers with 0-day and fake debugging-symbols tool		North Korean threat actors
07/09/2023	Russian government and defense organizations	RU	Multiple threat actors from North Korea
2023-10-16	RDP를 이용해 감염 시스템을 제어하는 Kimsuky 위협 그룹		Kimsuky
08/11/2023	IT Job Seekers	>1	BlueNoroff (AKA APT38, Sapphire Sleet, CageyChameleon, and CryptoCore)
20/11/2023	Organizations in Russia	RU	Konni
21/11/2023	Multiple western organizations	>1	Threat actors from North Korea
2023-11-21	북 해킹조직의 정부기관·언론사 등 사칭 전자우편 주의
25/11/2023	Indexed Finance	N/A	?
05/12/2023	South Korean companies connected to the defense industry	KR	Andariel
05/12/2023	Three organizations in South Korea and abroad	KR N/A	Andariel
2023-12-22	Kimsuky 그룹의 AppleSeed 악성코드 공격 동향 분석		Kimsuky
2023-03-30	금융보안인증 프로그램(이니세이프) 취약점 악용 해킹 [기사: 국정원, 보안인증 프로그램 취약점 활용한 북 해킹 포착]		북한
2023년 상반기	North Korean hacking groups attacking government, defense and finance about once a week; shift to zero-day attacks
2023년 하반기	KISA investigation of Lazarus zero-day attacks since early 2023: 75 companies (media, defense, software)
2023년 (2024 국가정보보호백서)	National Election Commission system exposed to hacking by North Korea and others for two years (disclosed May 2023)
2023년 (2024 국가정보보호백서)	Lazarus zero-day attacks on Korean companies since early 2023
2023년 (2024 국가정보보호백서)	NIS finds North Korean phishing sites cloning Korean portals (May 2023)
2023-02-02	북 해킹 조직, 공정거래위원회 사칭 피싱 공격 진행중!		KONNI; Konni; 코니
2023-01-17	국세청 세무조사 출석요구 안내문 사칭 공격… 北 배후 추정		KONNI; Konni; 김수키; 코니; 탈륨
2023-09-19	'금성121' APT 조직, 국내 정치사회적 이슈를 악용한 공격 진행중!		APT37; Geumseong121; ScarCruft; 금성121
2023-01-20	북 연계 해킹 조직, 대북 관련 종사자 대상 피싱 공격 진행중!		Smoke Screen; 스모크 스크린
2023-06-26	킴수키(Kimsuky)조직의 'Mail Online Security' 프로그램 위장 공격 주의!		Kimsuky; 북한 정찰총국; 블루 에스티메이트; 정찰총국; 킴수키
2023-03-21	ESRC 주간 Email 위협 통계 (3월 셋째주)		Kimsuky; 킴수키
2023-03-15	킴수키(Kimsuky)조직, '협의 이혼 의사 확인 신청서'를 위장한 QuasarRAT 유포 중!		Kimsuky; Smoke Screen; 스모크 스크린; 킴수키
2023-03-14	킴수키(Kimsuky), '사이버 안전국' 메일을 위장한 해킹 시도!		Kimsuky; 킴수키
2023-05-18	북 해킹조직, 대용량 악성LNK 파일을 이용한 공격 진행중!
2023-02-13	통일부 북한인권과 토론회로 둔갑한 北 해킹 공격 주의!
2023-02-01	네이버 로그인화면으로 위장한 웹페이지		Kimsuky
2023-02-03	정상 문서로 위장한 악성코드(kimsuky)		Kimsuky
2023-02-15	Anti-Forensic Techniques Used By Lazarus Group		APT38; Kimsuky; Lazarus
2023-03-03	국내 금융 기업 보안 메일을 사칭한 CHM 악성코드 : RedEyes(ScarCruft)		APT37; RedEyes; ScarCruft
2023-03-08	대북 관련 질문지를 위장한 CHM 악성코드 (Kimsuky)		Kimsuky
2023-03-10	패스워드 파일로 위장하여 유포 중인 악성코드		RedEyes; ScarCruft
2023-03-16	Unique characteristics of Kimsuky group’s spear phishing emails		Kimsuky
2023-03-16	2022 Threat Trend Report on Kimsuky		Kimsuky
2023-03-17	공인 인증 솔루션(VestCert) 취약점 주의 및 업데이트 권고		Lazarus; 라자루스
2023-03-17	자산 관리 솔루션(TCO!Stream) 취약점 주의 및 업데이트 권고		Lazarus
2023-03-20	사례비 지급 내용으로 위장한 OneNote 악성코드 (Kimsuky)		Kimsuky
2023-03-23	Kimsuky 그룹, 약력 양식 파일로 위장한 악성코드 유포 (GitHub)		APT37; Kimsuky; ScarCruft
2023-03-24	Kimsuky 그룹, ADS를 활용하여 악성코드 은폐		Kimsuky
2023-04-18	January 2023 Threat Trend Report on Kimsuky Group		Kimsuky
2023-04-18	February 2023 Threat Trend Report on Kimsuky Group		Kimsuky
2023-04-21	링크 파일(*.lnk)을 통해 유포되는 RokRAT 악성코드 : RedEyes(ScarCruft)		APT37; RedEyes; ScarCruft
2023-04-28	EDR 제품을 통한 RokRAT 유포 링크 파일(*.lnk) 추적 및 대응		APT37; RedEyes; ScarCruft
2023-05-24	March 2023 Threat Trend Report on Kimsuky Group		Kimsuky
2023-05-25	한컴 오피스 문서파일로 위장하여 유포중인 악성코드 증적 추적(RedEyes)		APT37; RedEyes
2023-06-09	Damages to Multiple Korean Websites Created by a Certain Website Development Company		APT37; RedEyes
2023-06-09	Threat Trend Report on Kimsuky – April 2023		Kimsuky
2023-06-09	Threat Trend Report on APT Groups – April 2023		APT37; Kimsuky; Lazarus; ScarCruft
2023-06-16	다양한 주제를 이용하여 CHM 악성코드를 유포 중인 Kimsuky		Kimsuky
2023-06-16	Malware Disguised as HWP Document File (Kimsuky)		Kimsuky
2023-06-28	크롬 원격 데스크톱을 악용하는 Kimsuky 공격 그룹		Kimsuky; 김수키
2023-06-29	문서 뷰어로 위장한 악성 배치 파일(*.bat) 유포 중(Kimsuky)		Kimsuky
2023-07-07	Threat Trend Report on Kimsuky – May 2023		Kimsuky
2023-07-07	Threat Trend Report on APT Groups – May 2023		APT37; Andariel; Kimsuky; Lazarus; ScarCruft
2023-07-20	국내 금융 기업 및 보험사를 사칭한 CHM 악성코드		APT37; RedEyes; ScarCruft
2023-07-31	코인 및 투자 관련 내용으로 위장한 악성코드 유포 중		Kimsuky
2023-08-16	Threat Trend Report on Kimsuky – June 2023		Kimsuky
2023-08-16	Threat Trend Report on APT Groups – June 2023		APT37; Andariel; Kimsuky; Lazarus
2023-09-01	Backdoor를 유포하는 악성 LNK : RedEyes(ScarCruft)		APT37; RedEyes; ScarCruft
2023-09-04	후쿠시마 오염수 방류 내용을 이용한 CHM 악성코드 : RedEyes(ScarCruft)		RedEyes; ScarCruft
2023-09-11	Threat Trend Report on Kimsuky Group – July 2023		Kimsuky
2023-09-11	Threat Trend Report on APT Groups – July 2023		KONNI; Kimsuky; Konni; Lazarus
2023-10-04	Lazarus 위협 그룹의 Volgmer, Scout 악성코드 분석 보고서		Andariel; Lazarus
2023-10-23	2023 Aug – Threat Trend Report on Kimsuky Group		Kimsuky
2023-10-23	2023 Aug – Threat Trend Report on APT Groups		APT37; Andariel; Kimsuky; Lazarus
2023-11-01	[Kimsuky] Operation Covert Stalker		Kimsuky
2023-11-13	2023 Sep – Threat Trend Report on Kimsuky Group		Kimsuky
2023-11-13	2023 Sep – Threat Trend Report on APT Groups		APT37; Andariel; KONNI; Kimsuky; Konni; Lazarus
2023-11-17	Andariel 그룹의 Apache ActiveMQ 취약점 (CVE-2023-46604) 공격 정황		Andariel; Kimsuky; Lazarus
2023-12-01	AutoIt을 사용해 악성코드를 제작하는 Kimsuky 그룹 (RftRAT, Amadey)		Kimsuky
2023-12-06	개인정보 유출 관련 내용으로 위장한 피싱 메일 유포 (Konni)		KONNI; Konni
2023-12-08	2023 Oct – Threat Trend Report on Kimsuky Group		Kimsuky
2023-12-08	2023 Oct – Threat Trend Report on APT Groups		Andariel; Kimsuky; Lazarus
2023-06-20	한국내 macOS 이용자를 노린 APT37 공격 등장		APT37; 북한연계
2023-05-23	북한인권단체를 사칭한 APT37 공격 사례		APT37; RedEyes; 북한 연계
2023-09-01	한국 내 대북분야 종사자를 겨냥한 고도화된 BitB 공격 등장		APT37; 북한 연계
2023-10-16	Operation DarkHorse CHM 기반 공격 분석		APT37; Kimsuky
2023-11-30	HWP 문서 내부에 악성 OLE 삽입 공격 FlowerPower APT 캠페인 Github C2 사용		APT37; Kimsuky
2023-10-30	Kimsuky APT 그룹의 Storm 작전과 BabyShark Family 연관 분석		Kimsuky; 김수키; 북한 연계
2023-07-31	국세청 우편물 발송 알림 사칭 공격 (Konni APT Campaign)		APT37; KONNI; Konni; 북한 연계; 코니
2023-09-26	통일 및 북한인권 분야 표적 Konni APT 캠페인		KONNI; Konni; 북한 연계; 코니
2023-12-29	북한 시장 물가 분석 문서 등으로 위장된 공격 사례		APT37; Kimsuky
2023-06-07	안보 관계자 대상 악성 전자우편 (2022년 4~7월) [기사: 한국 경찰청 “작년 안보관계자 해킹 배후는 북한”]		북한 해킹조직
2023-02-10	사이버 공간을 활용한 북한의 불법적 외화벌이 차단		북한
2023-05-23	한미, 북한 핵･미사일 자금줄 차단을 위해 북한 IT 인력에 대한 연쇄적 공동 조치 단행		북한; 북한 IT 인력
2023-06-02	북한 정권을 위해 정보·기술 탈취해 온 해킹조직 ‘김수키’ 겨눈다		김수키; 북한; 북한 IT 인력; 정찰총국
2023-12-27	우리 정부의 대북 독자제재 지정		북한; 정찰총국
2023-03-23	Scarcruft Bolsters Arsenal for targeting individual Android devices		Scarcruft
2023-10-30	FastViewer Variant Merged with FastSpy and disguised as a Legitimate Mobile Application		Kimsuky
2023-05-17	Detailed Analysis of AlphaSeed, a new version of Kimsuky’s AppleSeed written in Golang		Kimsuky
2023-03-17	Kimsuky group appears to be exploiting OneNote like the cybercrime group		Kimsuky
2023-05-24	[부처합동] 한미, 북한 핵･미사일 자금줄 차단을 위해 북한 IT 인력에 대한 연쇄적 공동 조치 단행		북한 IT 인력
2023-09-01	[부처합동] 우리 정부의 대북 독자제재 지정		북한
2023-04-11	APT-C-28（ScarCruft）组织对韩国地区攻击活动分析		APT-C-28; ScarCruft; Konni
2023-07-14	APT-C-28（ScarCruft）组织针对能源方向投放Rokrat后门活动分析		APT37; APT-C-28; ScarCruft; Reaper
2023-05-11	[북한의 對세계 해킹전쟁②] 탈취한 가상자산 현금화의 필수 과정 ‘세탁’		라자루스
2023-05-25	네이버·카카오 등 사칭 ‘해킹메일 전송’, 전체 북한 해킹수법의 74%
2023-06-22	북한의 스카크러프트, 새로운 멀웨어 사용해 탈북자 염탐		APT37; ScarCruft; 스카크러프트; Reaper
2023-10-29	북한, 무차별적 해킹으로 탈취한 가상화폐 2조 3천억원... 핵무기 개발에 썼다		라자루스
2023-12-01	북한 해킹그룹, 이번에는 사법부 망 뚫었나... 전산망 악성코드 감염 확인돼		Lazarus; 라자루스
2023-01-23	미 법원, 북 소행 ‘방글라데시 은행 해킹’ 소송 중재 명령		Lazarus; 라자루스
2023-10-15	起底朝鲜黑客组织Lazarus Group的攻击手法及洗钱模式_腾讯新闻		Lazarus; APT38
2023-12-04	一览朝鲜黑客Lazarus Group如何在6年窃取30亿美元加密货币_腾讯新闻		Lazarus
2023-08-11	미 법원, 북한 라자루스 탈취 암호화폐 자산 동결 판결...전문가 “신기술 적용 첫 조치”		라자루스
2023-07-19	국정원 “북한 IT 인력 국내 기업 해외지사 위장 취업 시도” - SPN 서울평양뉴스
2023-09-05T05:00:00.000Z	VMConnect PyPI campaign (in "Threat research roundup: Lessons learned from recent PyPI and npm supply chain attacks")		Lazarus; Labyrinth Chollima
December 12, 2023	How one country is impacting supply chains (North Korean supply chain attacks; Contagious Interview)		North Korean state-sponsored groups; Lazarus group
April 2023; June 2023 (updated version)	RustBucket macOS malware		BlueNoroff
February 2023	Attack on a defence company in Poland	Poland	Lazarus Group
2023-10-17	APT trends report Q3 2023 (DPRK-related paragraph 1)
2023	Malicious packages on the npm package manager		Lazarus Group
2023	Andariel exfiltration of pharmaceutical research and development and weapons development data		Andariel
first half of 2023	Attacks targeting China (government, financial, media, education sectors)	China	Lazarus Group; Kimsuky
2023	Activity in the Russian Federation (“still [has] access to a number of Russian systems”)	Russian Federation	Lazarus Group
2023	IT workers building or exploiting vulnerabilities in platforms and smart contracts; suspected smaller cryptocurrency heists; fake-identity employment		DPRK IT workers
14 September 2023	“Konni APT exploits WinRAR vulnerability (CVE-2023-38831) targeting the cryptocurrency industry,” Chuangyu 404 Advanced Threat Intelligence Team		ScarCruft (APT 37)
9 October 2023	“Detailed Malware Analysis Report: Putty disguised as malware (Lazarus APT),” Hauri		Lazarus Group
4 November 2023	“Crypto-Themed npm Packages Found Delivering Stealthy Malware,” Phylum Research Team
2023-12-05T10:00:34	BlueNoroff: new Trojan attacking macOS users
6 December 2023	“Analysis of North Korean Hackers’ Targeted Phishing Scams on Telegram,” SlowMist		Lazarus Group
2023-12-08T18:54:17.000Z	Analysis of Suspected Lazarus (APT-Q-1) Attack Sample Targeting npm Package Supply Chain
identified November 2023	Wagemole campaign (fake identities for remote IT jobs)		North Korean cyber actors
2023	Maverick hack		DPRK
June 2023	Atomic Wallet, Coinspaid, and Alphapo thefts (laundered via Huione Pay)		DPRK cyber actors
October and November 2023	KMCTC IT workers’ fraudulent employment with a Chinese regional hospital network	China	Korea Mangyongdae Computer Technology Corporation (KMCTC) IT workers
September 2023	Chonsurim IT workers working for a cryptocurrency-based online betting platform		Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense)
October 2023	Chonsurim IT workers developing smart contracts for a cryptocurrency staking company		Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense)
March and April 2023	Cryptocurrency investment scam by Laos-based IT worker Choe Kum Song		Choe Kum Song (Sangsin / SANS FAB)
May 2023	Han Kwang Hyok seeking use of a U.S. facilitator’s freelance platform account	United States	Han Kwang Hyok (Sangsin / SANS FAB)
2023 and 2024	Watering hole attacks via ROK authentication software and infiltration of IT asset management servers	Republic of Korea	Temp.Hermit
since at least June of 2023	IT worker team deploying BEAVERTAIL and INVISIBLE FERRET malware		an IT worker team
2023-10-18T16:30:00+00:00 (published_time)	Diamond Sleet software supply chain compromise of a German software provider (August 2023)	German	Diamond Sleet (ZINC)
publication date not shown on page (covers activity since June 2023)	Jade Sleet heist from a Singapore-based cryptocurrency platform (a month after early June 2023)	Singapore	Jade Sleet
publication date not shown on page (covers activity since June 2023)	Jade Sleet compromising online cryptocurrency casinos (August 2023)		Jade Sleet
publication date not shown on page (covers activity since June 2023)	Sapphire Sleet compromises of employees at cryptocurrency, venture capital and financial organizations		Sapphire Sleet
publication date not shown on page (covers activity since June 2023)	Citrine Sleet compromise of a Türkiye-based cryptocurrency firm following 3CX supply chain attack	Türkiye	Citrine Sleet
publication date not shown on page (covers activity since June 2023)	Diamond Sleet supply chain compromises of a Germany-based IT company (August 2023) and a Taiwan-based IT firm application (November 2023)	Germany; Taiwan	Diamond Sleet
publication date not shown on page (covers activity since June 2023)	Ruby Sleet and Onyx Sleet targeting aerospace and defense organizations	United States and South Korea	Ruby Sleet; Onyx Sleet
publication date not shown on page (covers activity since June 2023)	Emerald Sleet reconnaissance and spear-phishing of diplomats and Korean Peninsula experts		Emerald Sleet
publication date not shown on page (covers activity since June 2023)	Pearl Sleet targeting South Korean entities engaging with North Korean defectors and activists (June 2023)	South Korean	Pearl Sleet
publication date not shown on page (covers activity since June 2023)	Ruby Sleet backdoored installer of a South Korean electronic document program (December 2023)	South Korean	Ruby Sleet
publication date not shown on page (covers activity since June 2023)	North Korean cryptocurrency heists in 2023 (aggregate)		North Korean cyber actors
Microsoft Digital Defense Report 2023	Diamond Sleet compromising nuclear energy organizations (spring 2023) and maritime entities (fall 2022)	globally	Diamond Sleet
Microsoft Digital Defense Report 2023	Ruby Sleet use of a stolen IT security solutions provider certificate (early 2023)		Ruby Sleet
Microsoft Digital Defense Report 2023	Harmony Horizon Bridge heist (June 2022) attributed to Jade Sleet		Jade Sleet
Microsoft Digital Defense Report 2023	Emerald Sleet spear-phishing of Korean Peninsula experts	around the world	Emerald Sleet
Microsoft Digital Defense Report 2023	Sapphire Sleet fake LinkedIn investor profiles targeting blockchain-related targets		Sapphire Sleet
Microsoft Digital Defense Report 2023	Ruby Sleet fake LinkedIn profiles targeting a defense company and cybersecurity company in Israel	Israel	Ruby Sleet
Microsoft Digital Defense Report 2023	Ruby Sleet, Diamond Sleet, and Sapphire Sleet targeting maritime and shipbuilding sector (November 2022 to January 2023)		Ruby Sleet; Diamond Sleet; Sapphire Sleet
Microsoft Digital Defense Report 2023	Ruby Sleet and Diamond Sleet compromise of two arms manufacturing companies in Germany and Israel (November 2022 to January 2023)	Germany and Israel	Ruby Sleet; Diamond Sleet
Microsoft Digital Defense Report 2023	Diamond Sleet compromise of defense firms in Brazil, Czechia, Finland, Italy, Norway, and Poland (since January 2023)	Brazil, Czechia, Finland, Italy, Norway, and Poland	Diamond Sleet
Microsoft Digital Defense Report 2023	Diamond Sleet trojanized VNC compromise of a Russian nuclear energy organization (May 2023)	Russian	Diamond Sleet
Microsoft Digital Defense Report 2023	Ruby Sleet, Onyx Sleet and Opal Sleet targeting Russian aerospace institute, university, and diplomatic entities (March 2023)	Russian	Ruby Sleet; Onyx Sleet; Opal Sleet (likely)
2023-10-10 (datePublished)	COVID-19-focused DPRK task force targeting healthcare and research entities		overlaps with APT43 and TEMP.Hermit; unverified link to Andariel
2023-10-10 (datePublished)	Suspected APT37 GitHub repository with decoy documents (exposed March 2023)	South Korea	APT37
2023-10-10 (datePublished)	Andariel (UNC614) MAUI ransomware against hospitals		Andariel (UNC614)
CTA-NK-2023-0622 (report ID; June 2023)	North Korea's Cyber Strategy: 273 cyberattacks attributed to DPRK state-sponsored actors (July 2009 to May 2023)	South Korea; the US	Kimsuky; Lazarus Group; APT37
January 25, 2023	TA444 cryptocurrency theft (2021-2022)		TA444 (APT38, Bluenoroff, BlackAlicanto, Stardust Chollima, COPERNICIUM)
January 25, 2023	TA444 OneDrive credential harvesting campaign (early December 2022)	United States and Canada	TA444
May 24, 2023	TA444 phishing of a US digital banking institution (December 2022, CageyChameleon)	United States	TA444
2023-08-30T10:00:05	IT threat evolution in Q2 2023
2023-06-07T08:00:34	IT threat evolution Q1 2023
2023-10-18T10:00:51	Updated MATA attacks industrial companies in Eastern Europe
2023-04-27	APT trends report Q1 2023 (DPRK-related paragraph 1)
2023-04-27	APT trends report Q1 2023 (DPRK-related paragraph 2)
2023-04-27	APT trends report Q1 2023 (DPRK-related paragraph 3)
2023-04-27	APT trends report Q1 2023 (DPRK-related paragraph 4)
2023-06-07	High-profile malware and targeted attacks in Q1 2023 (DPRK-related paragraph 1)
2023-06-07	High-profile malware and targeted attacks in Q1 2023 (DPRK-related paragraph 2)
2023-07-27	APT trends report Q2 2023 (DPRK-related paragraph 1)
2023-07-27	APT trends report Q2 2023 (DPRK-related paragraph 2)
2023-07-27	APT trends report Q2 2023 (DPRK-related paragraph 3)
2023-07-27	APT trends report Q2 2023 (DPRK-related paragraph 4)
2023-07-27	APT trends report Q2 2023 (DPRK-related paragraph 5)
2023-07-27	APT trends report Q2 2023 (DPRK-related paragraph 6)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 1)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 2)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 3)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 4)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 5)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 6)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 7)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 8)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 9)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 10)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 11)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 12)
2023-08-30	IT threat evolution Q2 2023 (DPRK-related paragraph 13)
2023-10-17	APT trends report Q3 2023 (DPRK-related paragraph 2)
2023-10-17	APT trends report Q3 2023 (DPRK-related paragraph 3)
2023-01-04T13:28:11.000Z	LABScon Replay \| InkySquid: The Missing Arsenal \| SentinelOne
2023-07-05T13:59:43.000Z	BlueNoroff \| How DPRK’s macOS RustBucket Seeks to Evade Analysis and Detection \| SentinelOne
2023-03-09T06:00:00.000Z	The Week in Security: Lazarus attacks same South Korean entity twice, use of hard-coded secrets is up \| RL Blog
2023-05-25T05:00:00.000Z	The Week in Security: Lazarus targets Microsoft servers in espionage campaign, the future of PyPI \| RL Blog
2023-07-27T05:00:00.000Z	The Week in Security: North Korean APT targets developers, this Barbie is a cybercriminal \| RL Blog
2023-03-30T05:00:00.000Z	The Week in Security: Twitter gets subpoena for source code leak, 3CX supply chain attack surfaces \| RL Blog
2023-04-13T05:00:00.000Z	The Week in Security: 3CX attackers identified as North Korean, CISA pushes Secure by Design \| RL Blog
2023/02/23	WinorDLL64: A backdoor from the vast Lazarus arsenal?
2023/05/09	ESET APT Activity Report Q4 2022–Q1 2023 (DPRK-related paragraph 1)
2023/10/26	ESET APT Activity Report Q2–Q3 2023 (DPRK-related paragraph 1)
2023/10/26	ESET APT Activity Report Q2–Q3 2023 (DPRK-related paragraph 2)
2023/10/26	ESET APT Activity Report Q2–Q3 2023 (DPRK-related paragraph 3)
2023/10/26	ESET APT Activity Report Q2–Q3 2023 (DPRK-related paragraph 4)
2023-12-20T10:31:46.000Z	Analysis of Konni Group's Espionage Operation Using Email Security Inspection Manual as Bait
2023/02/08	ESET Threat Report T3 2022 (DPRK-related paragraph 1)
2023/01/31	ESET APT Activity Report T3 2022 (DPRK-related paragraph 1)
2023-12-19T03:09:44.762Z	3CX supply chain attack (mentioned in "Strengthening Crypto Supply Chain Security Is a Necessity, Not an Option")
2023-06-23T22:48:00+00:00	Phylum Discovers Sophisticated Ongoing Attack on NPM (later update: attributed to North Korea)		North Korean nation-state actors
2023-07-25T20:55:00+00:00	npm package-pair attack attributed to Jade Sleet (in Q2 2023 Evolution of Software Supply Chain Security Report)		Jade Sleet; TraderTraitor
2023-10-17T20:52:00+00:00	North Korean state-affiliated npm and PyPI attacks (in Q3 2023 Evolution of Software Supply Chain Security Report)		North Korean state-affiliated actors
November 1, 2023	Lazarus npm package-pair campaign against blockchain and cryptocurrency sectors (in "The mosaic of 2023's Software Supply Chain threats")		Lazarus
published 4 Aug 2023	Snyk Vulnerability Database: Malicious Package in eth-api-node (npm)		Lazarus Group
published 4 Aug 2023	Snyk Vulnerability Database: Malicious Package in xml2yaml (npm)		Lazarus Group
Q4 2023 (from title: APT QUARTERLY HIGHLIGHTS : Q4 - 2023)	Operation Dream Magic (MagicLine4NX exploitation via compromised news website)		Lazarus group
2023-03-16T00:00:00.000Z	Peeking at Reaper’s Surveillance Operations (Chinotto malware)	South Korea	Reaper (APT37)
2023-05-22T00:00:00.000Z	Unpacking Bluenoroff’s RustBucket Campaign		Bluenoroff