| 2024-10 | Play Ransomware | | Andariel |
| 2024-10 | Tapioca DAO | United States | Lazarus |
| 2024-10 | Radiant Capital | Hong Kong | Citrine Sleet |
| 2024-09 | Truflation | United States | |
| 2024-09 | BingX | Singapore | Lazarus |
| 2024-09 | DeltaPrime | Virgin Islands, British | Lazarus |
| 2024-09 | Indodax#2 | Indonesia | Lazarus |
| 2024-08 | Nexera | Netherlands | Lazarus |
| 2024-07 | WazirX | India | Lazarus |
| 2024-06 | AnOctopus | Korea, Republic of | Andariel |
| 2024-06 | CoinStats | Armenia | |
| 2024-06 | UwU Lend | | Lazarus |
| 2024-06 | Lykke | United Kingdom | |
| 2024-05 | DMM | Japan | |
| 2024-05 | FakePenny Ransomware | ZZZ | Moonstone Sleet |
| 2024-05 | Military Officials | Korea, Republic of | |
| 2024-05 | AlexLab | Singapore | Lazarus |
| 2024-04 | Rain.com | Bahamas | APT38 |
| 2024-04 | eScan | India | Kimsuky |
| 2024-03 | Solareum | United Arab Emirates | |
| 2024-03 | Munchables | United States | |
| 2024-03 | Asung Soft | Korea, Republic of | Kimsuky |
| 2024-01 | D2 Innovation | Korea, Republic of | Kimsuky |
| 2024-01 | Somesing | Korea, Republic of | Kimsuky |
| 2024-01 | HectorNetwork | | Lazarus |
| 2024-01 | Concentric.Fi | | Lazarus |
| 01.01.2024 | North Korean IT Worker from the State-Sponsored Fraud Group NICKEL TAPESTRY Stole Proprietary Data in Mid-2024 | Not available | NICKEL TAPESTRY |
| 01.08.2024 | North Korean state-sponsored hacking group Stonefly launched an attack on US companies in August 2024 | United States | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2024 | North Korean state-sponsored hacking group APT37 delivered a previously undocumented backdoor and remote access trojan called VeilShell to targets in Cambodia in 2024 | Cambodia | APT37 |
| 01.06.2024 | The North Korean state-sponsored hacking group UNC2970 gained access to a multinational energy company in June 2024 | Not available | Unknown |
| 19.08.2024 | North Korean Hacker Group Citrine Sleet Exploits Chromium Zero-Day Vulnerability on 19 August 2024 | United States | Unknown |
| 01.06.2024 | Lazarus APT group exploited a zero-day vulerability in early June 2024 against unspecified targets | Not available | Unknown |
| 01.01.2024 | North Korean hackers target South Korean defense contractor on 8 August 2024 | Korea, Republic of | Unknown |
| 01.04.2024 | North Korean APT Group Andariel targeted South Korean construction and machinery companies in April 2024 | Korea, Republic of;Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.05.2024 | The North Korean state-aligned hacking group Moonstone Sleet compromised an aircraft parts manufacturer in May 2024 | Not available | Unknown |
| 01.04.2024 | The North Korean state-aligned hacking group Moonstone Sleet compromised a drone technology company in April 2024 | Not available | Moonstone Sleet / Storm-1789 |
| 01.02.2024 | The North Korean state-aligned hacking group Moonstone Sleet has been infecting unnamed individuals or organisations with, among other things, the malware uploader YouieLoad since February 2024 | Not available | Unknown |
| 21.02.2024 | North Korean state-sponsored hacker group Kimsuky exploited vulnerabilities to gain access to ScreenConnect customer systems since at least 21 February 2024 | Not available | Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094 |
| 05.01.2024 | Lazarus Group suspected of having drained $7.5 million from crypto payment service provider CoinsPaid on 5 January 2024 | Estonia | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2024 | Operation “DEEP#GOSU” | | Kimsuky, Velvet Chollima |
| 2024-01 | North Korean hackers exploit VPN update flaw to install malware | | Kimsuky, Velvet Chollima |
| 2024-06-27 | Kimsuky Deploys TRANSLATEXT Chrome Extension |ThreatLabz | | |
| 2024-03 | Attack Activities by Kimsuky Targeting Japanese Organizations | | Kimsuky, Velvet Chollima |
| 2024-05 | North Korean Hackers Exploit Facebook Messenger in Targeted Malware Campaign | | Kimsuky, Velvet Chollima |
| 2024-07 | APT Group Kimsuky Targets University Researchers | | Kimsuky, Velvet Chollima |
| 2024-09 | North Korea Hackers Linked to Breach of German Missile Manufacturer | | Kimsuky, Velvet Chollima |
| 2024-09 | North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks | | Kimsuky, Velvet Chollima |
| 2024-02 | Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2024-05 | The Crypto Game of Lazarus APT: Investors vs. Zero-days | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2024-09-10T05:00:00.000Z | Fake recruiter coding tests target devs with malicious Python packages (VMConnect) | | Lazarus Group |
| 2024-11 | Operation “SyncHole” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2024-09 | Kimsuky-linked hackers use similar tactics to attack Russia and South Korea, researchers say | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2024-08-29T19:31:00+00:00 | North Korea Still Attacking Developers via npm | | groups aligned with North Korean objectives |
| 2024-04 | Operation “DEV#POPPER” | | [Unnamed groups: North Korea] |
| 2024-01-25 | Wall Street Memes | | |
| 2024-02-01 | Linkedin Job Dev Scam | | |
| 2024-02-09 | PlayDapp | | |
| 2024-02-13 | Duelbits | | |
| 2024-02-27 | Serenity Shield | | |
| 2024-02-28 | Braintrust Job Dev Scam | | |
| 2024-03-05 | MurAll | | |
| 2024-03-13 | NFPrompt | | |
| 2024-03-13 | CloudAI | | |
| 2024-03-16 | Wilder World | | |
| 2024-03-20 | Huge March 2024 Theft | | |
| 2024-04-02 | Unknown Apr Victim | | |
| 2024-04-11 | Endblock | | |
| 2024-05-06 | Genius / GNUS Token | | |
| 2024-05-22 | Exclusible Penthouse | | |
| 2024-05-28 | HYVE | | |
| 2024-05-29 | SpaceCatch | | |
| 2024-06-11 | Theft from Individual C7 | | |
| 2024-06-28 | Theft from Individual C4 | | |
| 2024-07-01 | Kyrrex | | |
| 2024-07-22 | Founder/CEO of I4 | | |
| 2024-07-24 | T6 | | |
| 2024-07-24 | Bmer01915811 | | |
| 2024-08-07 | Bitgert / BRISE | | |
| 2024-08-16 | Theft from Individual A4 | | |
| 2024-08-30 | Metaschool | | |
| 2024-09-13 | Adot | | |
| 2024-09-13 | HODL Token | | |
| 2024-09-19 | NiiFi | | |
| 2024-09-20 | Masa | | |
| 2024-09-20 | Dexnet | | |
| 2024-10-18 | Fake Hack VC Thefts | | |
| 2024-10-23 | Theft from Individual M4 | | |
| 2024-10-30 | Bitbucket Dev Scam | | |
| 2024-10-31 | Scallop | | |
| 2024-10-31 | M2 | | |
| 2024-11-15 | Nov 15 Contagious Interview | | |
| 2024-11-25 | TON Dude | | |
| 2024-11-28 | XT | | |
| 2024-11-29 | MAK / Metacene | | |
| 2024-12-05 | Fake UltraX Dex Job Scam | | |
| 2024-12-11 | Founder/CEO of O6 | | |
| 2024-12-12 | Willo Campaign | | |
| 2024-12-16 | Uknown Dec 2024 Theft | | |
| 2024-12-16 | SyFu | | |
| 2024-12-17 | Zigcoin | | |
| 2024-12-18 | Rainfi | | |
| 2024-12-30 | Napier Founder | | |
| May 2024 | Moonstone Sleet | Aerospace and defense industry firms | Believed to be associated with the North Korean government |
| September 20, 2024 | Shezmu | | |
| 2024-06-09 | Loopring | | |
| 2024-03-26 | PrismaFi | | DPRK (Unidentified) |
| 2024-06-22 | BTCTurk | | TraderTraitor |
| 2024-07-15 | Irys | | CryptoCore |
| 2024-09-26 | Onyx DAO | | DPRK IT workers |
| 2024-11-11 | DeltaPrime | | DPRK IT workers |
| July 25, 2024 | RGB 3rd Bureau (Andariel) global espionage against defense, aerospace, nuclear, engineering | | Andariel, Onyx Sleet (formerly PLUTONIUM), DarkSeoul, Silent Chollima, and Stonefly/Clasiopa (RGB 3rd Bureau) |
| 2024-05-16 (press release date) | Charges and Seizures Brought in Fraud Scheme, Aimed at Denying Revenue for Workers Associated with North Korea | | |
| 2024-07-25 (press release date) | North Korean Government Hacker Charged for Involvement in Ransomware Attacks Targeting U.S. Hospitals and Health Care Providers | | |
| 2024-08-08 (press release date) | Justice Department Disrupts North Korean Remote IT Worker Fraud Schemes Through Charges and Arrest of Nashville Facilitator | | |
| 2024-12-12 (press release date) | Fourteen North Korean Nationals Indicted for Carrying Out Multi-Year Fraudulent Information Technology Worker Scheme and Related Extortions | | |
| 28/02/2024 | Organizations in Japan | JP | Lazarus |
| (published February 28, 2024) | Lazarus malicious npm package containing Comebacker (case reported by Phylum) | | Lazarus (as considered by JPCERT/CC) |
| 2024-09-18T14:00:59 | Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors | | |
| (advisory reference 0924; September 2024) | DPRK IT workers targeting UK firms disguised as freelance third-country IT workers | United Kingdom | DPRK IT workers |
| (Annual Review 2024) | DPRK targeting of cryptocurrency companies/users and data theft from defence, governments, academia; DPRK IT workers targeting UK firms | United Kingdom | DPRK threat actors |
| im Jahr 2024 | Cyber espionage against aerospace and propulsion technology companies via social engineering (RGB/Lazarus) | | Reconnaissance General Bureau (RGB); APT-Gruppierung Lazarus |
| (not dated; reported 2024) | North Korean IT workers employed by German companies | Germany | Nordkorea (getarnte IT-Fachkräfte) |
| in 2024 | North Korean cryptocurrency theft total for 2024 (citing MSMT report) | | North Korean cyber actors |
| (reporting period 2024-2025) | North Korean hackers stole digital currency from Dutch organisations among others | Netherlands | Noord-Koreaanse hackers |
| (reporting period 2024-2025) | Cyber attacks on Dutch organisations by North Korean hackers (per CrowdStrike reporting cited by NCTV) | Netherlands | Noord-Koreaanse hackers (per CrowdStrike) |
| since at least Dec ember 2024 | Spotlight: Uncovered Russia-based North Korean IT Worker Cell | Russia | North Korean IT workers |
| 21/08/2024 | Undisclosed organization(s) | Unknown | UAT-5394 linked to Kimsuky |
| 2024-01-01 | 1st January – Threat Intelligence Report | | |
| 03/01/2024 | Multiple organizations within the cryptocurrency and the blockchain industries | >1 | TA444 (a.k.a. Sapphire Sleet, BLUENOROFF, STARDUST CHOLLIMA) |
| 2024-04-29 | 29th April – Threat Intelligence Report | | |
| 23/07/2024 | KnowBe4 | US | Threat actors from North Korea |
| 2024-09-26T03:00:51 | Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy | | |
| 2024-10-21 | 21st October – Threat Intelligence Report | | |
| 2024-12-19T10:00:55 | Lazarus group evolves its infection chain with old and new malware | | |
| 25/12/2024 | Multiple Organizations | >1 | ? |
| September 16 2024 | Jamf Threat Labs observes targeted attacks amid FBI warnings | | DPRK |
| On or about March 13, 2024 | Theft from online platform COMPANY-2 via malware deployed by CryptoMimic actors (funds traced to MEXC accounts) | | North Korean cyber actors; CryptoMimic actors |
| March 15, 2024 | Theft from Company 1 by a developer later determined to be a North Korean IT worker (exploit of master smart contract) | | North Korean IT workers; North Korean actors |
| in or around August 2024 | Theft from Company 1 (U.S.-based, headquartered in New York) linked to IT worker persona Bong Chee Shen | U.S. (New York) | North Korean IT workers; Bong Chee Shen persona (used by Chang Nam Il, a North Korean citizen) |
| on or about January 9, 2024 (hired); January 19, 2024 (remote access installed) | Overseas IT worker posing as "Lan Duc N." employed at Company C, a California-based defense contractor; laptop routed through Kejia Wang and Zhenxing Wang | U.S. (California) | overseas co-conspirator (Individual C managed an IT company based in North Korea); Kejia Wang; Zhenxing Wang |
| September 2024 | Circle froze USDC in three Ethereum wallets belonging to North Korea or the Lazarus Group | | North Korea; Lazarus Group |
| published 2024-12-19 | DPRK crypto theft in 2024 (annual total) | | Hackers linked to North Korea |
| published 2024-01-24 | DPRK crypto theft in 2023 (annual total) | | North Korea-linked hackers (Kimsuky and Lazarus Group named) |
| published 2024-01-05 | North Korean crypto theft in 2023 (annual total) | | Hackers tied to North Korea |
| 2024-01-06 (post date) | CoinsPaid/Alphapo hack of July 2023 (referenced in post on new CoinsPaid incident) | | DPRK |
| 2024-04-29 (post date) | Lazarus Group laundering of 25+ crypto hacks from 2020-2023 (ZachXBT 15 month investigation) | | Lazarus Group |
| 2024-09-14 (post date) | Stablecoin issuers blacklist Lazarus-related addresses from ZachXBT investigation | | Lazarus Group |
| 2024-01-03T18:09:34.148Z | Orbit Bridge Hackers Drain $81 Million in Crypto Assets | | state-sponsored North Korean hackers (suggested by Taylor Monahan) |
| Sep, 2024 | Linkedin Job Dev Scam | | DPRK-affiliated groups |
| over the last several months (2024) | Research/pre-operational targeting of cryptocurrency ETF-related companies | | North Korean malicious cyber actors |
| 2024 | Social engineering (fake employment/investment offers) against DeFi and cryptocurrency firms | | North Korean state-sponsored actors |
| 02/05/2024 | Multiple organizations | >1 | APT43 (a.k.a. Kimsuky, Emerald Sleet, Velvet Chollima, and Black Banshee) |
| 2024 | DPRK IT worker schemes revenue (nearly $800 million in 2024) | | DPRK government |
| between on or about Jan. 19, 2024, and on or about April 2, 2024 | ITAR data accessed at California defense contractor | United States | overseas co-conspirator (DPRK IT worker scheme) |
| 2024 | DMM Bitcoin ($308 million), Upbit ($50 million), Rain Management ($16.13 million) thefts attributed to DPRK | | 北朝鮮 (DPRK); Lazarus Group named in statement |
| 昨年 (2024) | WazirX ($235 million) and Radiant Capital ($50 million) thefts attributed to DPRK by US and ROK | | 北朝鮮 (DPRK) |
| 2024 年９月 | Social engineering targeting of the cryptocurrency industry deploying TraderTraitor, AppleJeus and other malware | | 北朝鮮 (DPRK) |
| 1 October 2024 | North Korean IT workers offering remote services to companies worldwide | | North Korean intelligence services; IT workers |
| 2024-01-22T13:55:47.000Z | ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals | SentinelOne | | |
| 2024-02-14 | 북한 해커, 대통령실 행정관의 네이버 메일을 어떻게 해킹했나 | | |
| 14/02/2024 | Individuals in South Korea | KR | Gyeongheung |
| 19/02/2024 | Undisclosed research center for maritime and shipping technologies | N/A | Threat actor from North Korea |
| 19/02/2024 | Organization in the defense sector | N/A | Lazarus |
| 21/02/2024 | Russian Consular Department of the Ministry of Foreign Affairs (MID) | RU | Konni (a.k.a. Opal Sleet, Osmium, or TA406) |
| 2024-02-28 | Microsoft Windows의 보안 업데이트 권고 (CVE-2024-21338) | | Lazarus |
| 2024-03-04 | 北 , 국내 반도체 기업 해킹으로 설계도면과 현장사진 훔쳐갔다 | | |
| 21/03/2024 | Multiple organizations | N/A | Kimsuky a.k.a. Black Banshee,Thallium |
| 07/04/2024 | Multiple organizations | >1 | Vedalia (a.k.a. Konni) |
| April 16, 2024 | TA427 benign-conversation phishing of foreign policy experts with DMARC abuse (since 2023) | US; Republic of Korea (ROK or South Korea) | TA427 (Emerald Sleet, APT43, THALLIUM, Kimsuky) |
| 18/04/2024 | Individuals in the Asian region | >1 | Lazarus |
| 22/04/2024 | Multiple organizations in South Korea | KR | TA427, a.k.a. Emerald Sleet, APT43, THALLIUM or Kimsuky. |
| 2024-04-23 | 국내 방산업체 83곳 공격, 10여곳 해킹 [기사: 라자루스·안다리엘·김수키까지 北 해커조직 총동원... 국내 방산업체 83곳 공격해 10여곳 해킹] | | 라자루스; 안다리엘; 김수키 |
| 09/05/2024 | Two South Korean cryptocurrency firms | KR | Kimsuky |
| 16 May 2024 | Springtail: New Linux Backdoor Added to Toolkit | | |
| 2024-05-16 | Dora RAT을 이용한 국내 기업 대상 APT 공격 사례 분석 (Andariel 그룹) | | Andariel; Kimsuky; Lazarus |
| 28/05/2024 | Multiple organizations | >1 | Moonstone Sleet (previously tracked as Storm-1789) |
| 12/06/2024 | Cryptocurrency professionals in Brazil | BR | PUKCHONG a.k.a. UNC4899) |
| 12/06/2024 | Aerospace firms in Brazil | BR | PAEKTUSAN |
| 12/06/2024 | Diplomats in Brazil | BR | PRONTO |
| June 13, 2024 | A New North Korean Group Emerges, Disrupting the Open-Source Ecosystem (Moonstone Sleet npm packages) | | Moonstone Sleet; Jade Sleet |
| 2024-06-24 | 국내 기업 대상 공격에 사용 중인 Xctdoor 악성코드 (Andariel) | | Andariel; Kimsuky; Lazarus |
| 2024-06-26 | Kimsuky 그룹의 신규 백도어 등장 (HappyDoor) | | Kimsuky |
| 15/07/2024 | Job seekers in multiple countries | >1 | Threat actors from North Korea |
| 25/07/2024 | Organizations in the healthcare, energy and financial sectors | >1 | APT45 a.k.a. Andariel, Onyx Sleet, Stonefly, and Silent Chollima |
| 31/07/2024 | Multiple organizations across South Korea, North America, Europe, and the Middle East | KR >1 | Threat actors from North Korea |
| 2024-07-31T00:00:00Z | Stressed Pungsan: DPRK-aligned threat actor leverages npm for initial access | | Stressed Pungsan; MOONSTONE SLEET |
| 05/08/2024 | Construction and machinery companies in South Korea | KR | Kimsuky (APT43) and Andariel (APT45) |
| 13/08/2024 | Crypto investors | >1 | Lazarus |
| 16/08/2024 | Blockchain engineers | >1 | BlueNoroff |
| 2024-08-20T05:00Z (datePublished) | FAMOUS CHOLLIMA insider IT worker infiltration of U.S. technology companies (2024 Threat Hunting Report) | U.S. | FAMOUS CHOLLIMA |
| 03/09/2024 | Organizations in the cryptocurrency sector | >1 | Threat actors from North Korea |
| 2024-09-04T06:52:35+00:00 | APT Lazarus: Eager Crypto Beavers, Video calls and Games | Group-IB Blog | | |
| 09/09/2024 | Several unnamed South Korean enterprises, including a tax law firm. | RU | Konni (linked to the North Korean state-sponsored group Kimsuky) |
| 2024-09-17 (datePublished) | UNC2970 trojanized SumatraPDF job lures (MISTPEN via BURNBOOK) against energy and aerospace | U.S. | UNC2970 |
| 2024-09-19 | 강연의뢰서로 위장한 Kimsuky 그룹 악성코드(MSC, HWP) | | Kimsuky |
| 2024-10-09T03:00:54 | Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware | | |
| 13/10/2024 | Organizations in the financial space | >1 | Threat actors from North Korea (Hidden Cobra) |
| May 2024 | “Operation Code on Toast”: IE zero-day via pop-up “toast ads” against ROK national security officials and DPRK-related NGOs (RokRAT) | Republic of Korea | APT37 |
| 16/10/2024 | Undisclosed organization | Unknown | Threat actor from North Korea |
| 17/10/2024 | Multiple organizations in the cryptocurrency sector | >1 | Lazarus |
| 2024-10-24T00:00:00Z | Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview | US | Tenacious Pungsan |
| 04/11/2024 | Multiple organizations | >1 | Threat actors from North Korea |
| 2024-11-07T10:55:47.000Z | BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence | SentinelOne | | |
| 12/11/2024 | Multiple organizations | >1 | Threat actors from North Korea |
| 2024-11-13T05:55:12+00:00 | Stealthy Attributes of APT Lazarus | Group-IB Blog | | |
| 2024-11-14T15:00:12 | Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack | | |
| 2024-11-21T10:55:47.000Z | DPRK IT Workers | A Network of Active Front Companies and Their Links to China | SentinelOne | | |
| 2024-11-22T11:00:00+00:00 (published_time) | Sapphire Sleet cryptocurrency theft (fake venture capitalist / recruiter schemes) | | Sapphire Sleet |
| 22/11/2024 | Aerospace and defense companies | >1 | Ruby Sleet |
| 25/11/2024 | Multiple organizations in China and Russia | CN RU | Threat actors from North Korea |
| 2024-12-02 | 위협 행위자 김수키의 이메일 피싱 캠페인 분석 | | Kimsuky; 김수키 |
| 2024년 하반기 | KISA analysis of malware used by Lazarus against South Korean companies in 2024 | | |
| 2024년 하반기 | Lazarus SCOUT downloader found in a 2024 incident | | |
| 2024-01-26 | WinRAR 취약점(CVE-2023-38831) 분석 보고서 | | APT37; KONNI; Konni; 코니 |
| 2024-03-12 | 북 김수키(Kimsuky) 조직의 정책 자문 위장 스피어 피싱 주의! | | Kimsuky; 김수키 |
| 2024-01-04 | 2023년 12월 Kimsuky 그룹 동향 보고서 | | Kimsuky |
| 2024-01-09 | 2023년 12월 APT 그룹 동향 보고 | | Andariel; Lazarus |
| 2024-01-17 | Lazarus 그룹 DLL-Side Loading 기법 이용 (2) | | Lazarus |
| 2024-02-08 | Kimsuky Group’s Spear Phishing Detected by AhnLab EDR (AppleSeed, AlphaSeed) | | Kimsuky |
| 2024-02-08 | 2024년 1월 APT 그룹 동향 보고서 | | Kimsuky |
| 2024-03-11 | 국내 자산 관리 솔루션을 악용하여 공격 중인 Andariel 그룹 (MeshAgent) | | Andariel; Kimsuky; Lazarus |
| 2024-04-05 | 2024년 3월 APT 그룹 동향 보고서 | | Andariel; Kimsuky |
| 2024-04-23 | RokRAT 악성코드를 유포하는 LNK 파일 (수료증 위장) | | RedEyes; ScarCruft |
| 2024-04-24 | 사용자 정보를 탈취하는 CHM 악성코드 국내 유포 | | Kimsuky |
| 2024-05-09 | 2024년 4월 APT 그룹 동향 보고서 | | Kimsuky; Lazarus |
| 2024-05-27 | 국내 기업 대상 공격에 사용 중인 SmallTiger 악성코드 (Kimsuky, Andariel 그룹) | | Andariel; Kimsuky |
| 2024-05-29 | MS-Office 수식 편집기 취약점을 이용해 설치되는 키로거 (Kimsuky) | | Kimsuky |
| 2024-06-05 | 2024년 5월 APT 그룹 동향 보고서 | | Andariel; Kimsuky |
| 2024-07-05 | Kimsuky 그룹이 사용하는 Github Repository | | Kimsuky |
| 2024-08-12 | 2024년 7월 APT 그룹 동향 보고서 | | APT45; Andariel |
| 2024-09-06 | 러시아와 북한 파트너쉽에 관한 논문을 위장한 APT 공격 (Kimsuky) | | Kimsuky |
| 2024-10-24 | PebbleDash와 RDP Wrapper를 악용한 Kimsuky 그룹의 최신 공격 사례 분석 | | Kimsuky; Lazarus |
| 2024-11-12 | 2024년 10월 APT 그룹 동향 보고서 | | Andariel |
| 2024-11-22 | 2024년 MSC 악성코드 동향 보고서 | | Kimsuky |
| 2024-12-23 | Andariel 그룹의 국내 솔루션 대상 공격 사례 분석 (SmallTiger) | | Andariel |
| 2024-11-05 | APT37 위협 배후의 사이버 정찰 활동 분석 | | APT37; 북한 연계 |
| 2024-07-31 | AutoIt 활용 방어 회피 전술의 코니 APT 캠페인 분석 | | KONNI; Kimsuky; Konni; 김수키; 코니 |
| 2024-03-13 | 비트코인 시세 급등에 따른 해킹 피해 주의보 | | KONNI; Konni; 코니 |
| 2024-10-04 | 김수키(Kimsuky)그룹의 'BlueShark' 위협 전술 분석 | | Kimsuky; 김수키 |
| 2024-06-05 | 외신 인터뷰 의뢰 사칭 김수키 공격 발견 | | Kimsuky; 김수키 |
| 2024-09-05 | 코니(Konni) 위협 세계관의 확장 분석 리포트 | | KONNI; Kimsuky; Konni; 김수키; 코니 |
| 2024-03-27 | APT37 그룹의 RoKRAT 파일리스 공격 증가 | | APT37; KONNI; Kimsuky; Konni; Lazarus; 김수키; 라자루스; 코니 |
| 2024-01-16 | 2024년 Webinar 안내장 사칭 APT 공격 포착 | | APT37 |
| 2024-11-21 | 업비트 이더리움 탈취 (2019년 11월) [기사: 경찰 "업비트 이더리움 580억 탈취, 북한 해킹조직 소행"] | | 라자루스; 안다리엘 (북한 정찰총국) |
| 2024-03-28 | 한미, 북핵･미사일 자금 조달 북한 IT 인력 활동 공동 제재 | | 북한; 북한 IT 인력 |
| 2024-04-02 | 우리 정부의 대북 독자제재 지정 | | 북한; 북한 IT 인력 |
| 2024-12-26 | 우리 정부의 대북 독자제재 지정 | | 북한; 북한 IT 인력 |
| 2024-08-22 | Threat Tracking: Analysis of puNK-003’s Lilith RAT ported to AutoIt Script | | puNK-003 |
| 2024-10-02 | [VirusBulletin 2024] Go-ing Arsenal: A Closer Look at Kimsuky’s Go Strategic Advancement | | APT43; Kimsuky |
| 2024-05-10 | 北 해커조직, 법원 전산망 침입해 개인정보 1014GB 해킹 | | 라자루스 |
| 2024-01-08 | 북한 김수키 해킹그룹의 유형별 스피어피싱 공격사례 분석해 보니 | | Kimsuky; 김수키 |
| 2024-07-18 | 북 라자루스, 전세계에서 탈취한 가상자산 캄보디아에서 현금화 | | Lazarus; 라자루스 |
| 2024-07-29 | 북한 김수키 추정 해킹그룹, 고려대와 성균관대 등 대학 피싱 사이트로 워터링 홀 공격 노렸나 | | Kimsuky; 김수키 |
| 2024-08-05 | 북한 해킹그룹, 국내 건설 및 기계 분야 집중 공격... 정부, 사이버 보안 권고문 배포 | | |
| 2024-08-13 | 해킹으로 인한 가상화폐 피해 금액 50%, 북한 소행으로 추정 | | Lazarus; 라자루스 |
| 2024-03-04 | APT37利用朝鲜政治话题针对韩国的攻击活动分析 | | APT37; ScarCruft; Reaper |
| 2024-02-16 | 박성수 카스퍼스키 책임 “北 김수키 해킹그룹, 매일매일 공격…더 정교해지고 있다” | | Kimsuky; 김수키 |
| 2024-05-15 | [ET단상]한바탕 휩쓴 방산 해킹 사건, 보안의 다른 '답'을 찾아야 할 때 | | |
| 2024-01-24 | 국정원 “작년 공공기관 해킹 시도 80%가 북한 소행” | | |
| 2024-08-14 | “북 해킹 고도화…전체 가상화폐 피해액 34% 차지” | | |
| 2024-11-25 | [북한 물가] 비트코인과 북한의 해킹 | | |
| 2024-10-09 | [단독] 북한 추정 해킹 공격…원전 자료 70만 건 유출 | | |
| 2024-03-15 | “북한 해킹 조직 라자루스, ‘토네이도 캐시’ 통해 2300만 달러 자금 세탁” | | 라자루스 |
| 2024-10-07 | 미 법무부, ‘라자루스’ 탈취 자산 몰수 소송…“북한 범죄 억제 목적” | | 라자루스 |
| 2024-05-15 | [유미's 픽] "北에 탈탈 털려도 몰랐다"…방만한 공공기관 보안 의식, 처벌은 솜방망이? | | 라자루스 |
| 2024-05-24 | 瑞星EDR还原APT37组织对中韩食品行业攻击过程-AI云资讯 | | APT37; Konni; Reaper |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet malicious tank game DeTankWar | | Moonstone Sleet |
| Throughout 2024 | CryptoCore fake-recruiter campaign contacting over 1,200 cryptocurrency company employees (Slack skill assessment tests) | over a dozen countries | CryptoCore |
| December 2024 | Targeting of James Tang of Fenbushi Capital with fake meeting links | China | DPRK cyber actors |
| 2024 | Cryptocurrency thefts by DPRK IT workers (OnyxDAO, Exclusible Penthouse, BTCTurk) | | DPRK IT workers (according to one private sector partner) |
| January 2024 - September 2025 (reporting period) | Andariel compromises of U.S., ROK, UAE and Israeli IT and defense-related companies | United States; Republic of Korea; UAE; Israel | Andariel |
| 2024 | Data theft and extortion of a U.S. aerospace company | United States | Moonstone Sleet |
| 2024 | Attempted sale of stolen data (NASA, a private U.S. company, UAE government, Spanish healthcare group, Austria-based jet charter) to Stormous ransomware group | United States; UAE; Spain; Austria | DPRK cyber actors (alias linked to Moonstone Sleet’s FakePenny) |
| Throughout 2024 | IT workers using 12 personas via recruitment agencies at European defense subcontractors | Europe | DPRK IT workers (per Mandiant) |
| April to May 2024 | Suspected IT workers seeking jobs requiring U.S. security clearance and at a U.S. government contractor | United States | suspected DPRK IT workers (per Mandiant) |
| late 2024 | One IT worker operating at least 12 personas across Europe and the United States | Europe; United States | a DPRK IT worker |
| since late October 2024 | Extortion by fired IT workers threatening to release former employers’ data | | DPRK IT workers (per Mandiant) |
| 2024 and 2025 | Animation work under false identities (HBO Max, Amazon, Japanese studios) – Dalian Shepherd Boy Animation Studio | China | DPRK IT workers / Dalian Shepherd Boy Animation Studio |
| November and December 2024 | Chonsurim meme coin project intended to defraud investors | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| March 2024 | Chonsurim IT worker employed by a U.S. CRM company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| eight years up to November 2024 | Chonsurim developers employed by a U.S. CRM company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| June to November 2024 | An Chung Yol IT work for U.S. healthcare, content provider and IT training companies | United States | An Chung Yol (Sangsin / SANS FAB) |
| 2024 | U.S.-incorporated front company Guanghe Technology Development LLC used to secure contracts with a Serbian company | United States; Serbia | North Korean IT workers based in China |
| 2024 (arrest) | Ukraine-based facilitator Oleksandr Didenko’s laptop farms supporting at least 300 North Korean IT workers | Ukraine; Poland (arrest); United States (laptop farms) | facilitator for DPRK IT workers |
| 2024 | Japan case 3: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| 2024 | Japan case 4: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| December 2024 | Compromise of Chinese drone manufacturer DJI | China | TraderTraitor |
| May 2024 | Supply chain attack via a DLP software update server against ROK aerospace and shipbuilding defense companies | Republic of Korea | Andariel |
| revealed October 2024 [as printed] | Ransomware-funded data exfiltration from NASA, U.S. Air Force, defense companies, a Chinese energy company, a Taiwan-based defense company and two ROK defense companies | United States; China; Taiwan; Republic of Korea | Rim Jong Hyok and RGB co-conspirators |
| January 2024 - September 2025 (reporting period) | IT workers’ fake job offer compromise of an employee computer at a defense company | | DPRK IT workers |
| February 2024 | Impersonation of Crypto.com with malicious job-description PDFs | | TraderTraitor |
| fall 2024 | Fake videoconferencing troubleshooting spear phishing campaign (AppleScripts) | | CryptoCore |
| 2024-02-14T12:00:00+00:00 (published_time) | Emerald Sleet spear-phishing of experts on North Korea and use of LLMs | | Emerald Sleet (THALLIUM); overlaps Kimsuky, Velvet Chollima |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet trojanized PuTTY via LinkedIn, Telegram and freelancing platforms (August 2023) | | Moonstone Sleet (formerly Storm-1789) |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet malicious npm packages / fake skills assessments | | Moonstone Sleet |
| 2024-05-28T16:00:00+00:00 (published_time) | Moonstone Sleet fake companies StarGlow Ventures and C.C. Waterfall email campaigns | | Moonstone Sleet |
| 2024-07-25T15:57:18+00:00 (published_time) | Onyx Sleet intelligence-gathering campaigns; May 2024 targeting of South Korean educational institutions, construction and manufacturing organizations | India, South Korea, and the United States; South Korean | Onyx Sleet |
| 2024-11-22T11:00:00+00:00 (published_time) | Ruby Sleet supply chain attack on a Korean construction company (VeraPort) and aerospace/defense compromises | Korean | Ruby Sleet |
| 2024-11-22T11:00:00+00:00 (published_time) | North Korean IT workers (repository found October 2024) | operating out of North Korea, Russia, and China | North Korean IT workers |
| Microsoft Digital Defense Report 2024 | Jade Sleet, Sapphire Sleet, and Citrine Sleet targeting cryptocurrency organizations (since 2023) | | Jade Sleet; Sapphire Sleet; Citrine Sleet |
| Microsoft Digital Defense Report 2024 | North Korean targeting by region and sector (United States first, United Kingdom second; IT sector most targeted) | The United States; the United Kingdom | North Korean threat actors |
| 2024-07-25 (datePublished) | APT45 targeting of nuclear research facilities and Kudankulam Nuclear Power Plant (2019) | India | APT45 |
| 2024-07-25 (datePublished) | APT45 targeting of a South Korean financial organization (2016) and spear-phishing of a South Asian bank (2021) | South Korean; South Asian | APT45 |
| 2024-07-25 (datePublished) | APT45 targeting of crop science division of a multinational corporation (September 2020) | | APT45 |
| 2024-07-25 (datePublished) | APT45 long-running espionage, financial and possible ransomware operations (since 2009) | | APT45 |
| 2024-09-23 (datePublished) | DPRK IT workers (UNC5267) obtaining remote employment; facilitator case | U.S.; China and Russia, with smaller numbers in Africa and Southeast Asia | UNC5267 (DPRK IT workers) |
| 2024-05-09 | Kaspersky report on APT trends in Q1 2024 (DPRK-related paragraph 1) | | |
| 2024-05-09 | Kaspersky report on APT trends in Q1 2024 (DPRK-related paragraph 2) | | |
| 2024-05-09 | Kaspersky report on APT trends in Q1 2024 (DPRK-related paragraph 3) | | |
| 2024-05-09 | Kaspersky report on APT trends in Q1 2024 (DPRK-related paragraph 4) | | |
| 2024-05-09 | Kaspersky report on APT trends in Q1 2024 (DPRK-related paragraph 5) | | |
| 2024-06-03 | Non-mobile malware statistics, Q1 2024 (DPRK-related paragraph 1) | | |
| 2024-11-28 | Kaspersky report on APT trends in Q3 2024 (DPRK-related paragraph 1) | | |
| 2024-11-28 | Kaspersky report on APT trends in Q3 2024 (DPRK-related paragraph 2) | | |
| 2024-11-28 | Kaspersky report on APT trends in Q3 2024 (DPRK-related paragraph 3) | | |
| 2024-11-13T03:00:36 | Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them | | |
| 2024-09-09T15:00:58 | Threat Assessment: North Korean Threat Groups | | |
| 2024-05-08T10:00:18.000Z | LABScon23 Replay | macOS Components Used in North Korean Crypto-Heists | SentinelOne | | |
| Wed, 18 Sep 2024 00:00:00 GMT | Code of Conduct: DPRK’s Python-fueled intrusions into secured networks | | |
| 2024-09-03T13:00:30.000Z | PinnacleOne ExecBrief | North Korean IT Worker Threat | SentinelOne | | |
| 2024-11-04 | North Korean remote workers landing jobs in the West | ThreatLabz | | |
| 2024/06/14 | ESET Research Podcast: APT Activity Report Q4 2023–Q1 2024 (DPRK-related paragraph 1) | | |
| 2024/05/14 | ESET APT Activity Report Q4 2023–Q1 2024 (DPRK-related paragraph 1) | | |
| 2024-03-25T11:00:06.000Z | Konni组织针对虚拟货币行业投递AutoIt恶意软件 | | |
| 2024/11/07 | ESET APT Activity Report Q2 2024–Q3 2024 (DPRK-related paragraph 1) | | |
| 2024-01-16T06:00:00.000Z | PyPI campaign mimicking open-source Python tools, attributed to Lazarus offshoot (in "SSCS attacks: A (partial) history") | | offshoot of the Lazarus threat group |
| 2024-01-16T06:00:00.000Z | Thallium abuse of stock investment platform installer (in "SSCS attacks: A (partial) history") | | Thallium |
| 2024-02-20T06:00:00.000Z | Lazarus DLL sideloading via IDA Pro library (mentioned in "Attackers leverage PyPI to sideload malicious DLLs") | | Lazarus Group |
| 2024-03-12T05:00:00.000Z | DPRK cryptocurrency theft total (mentioned in BIPClip post) | | nation-state actors affiliated with the Democratic Republic of North Korea (DPRK) |
| 2024-06-10T05:00:00.000Z | 3CX compromise (mentioned in "How to assess and manage commercial software risk") | | Lazarus |
| 2024-07-31T05:00:00.000Z | 3CX attack (mentioned in "Are you prepared for modern supply chain threats?") | | North Korean attackers |
| 2024-10-09T05:00:00.000Z | TeamCity CVE-2023-42793 exploitation by North Korean groups (in "5 commercial software attacks") | | multiple North Korean groups |
| 2024-01-22T20:47:00+00:00 | Lazarus npm social engineering campaigns 2023 (in Q4 2023 Evolution of Software Supply Chain Security Report) | | Lazarus group |
| 2024-04-15T20:27:00+00:00 | npm code-profiler package / fake job social engineering campaign (in Q1 2024 Evolution of Software Supply Chain Security Report) | | North Korean state-sponsored efforts |
| 2024-04-24T16:43:00+00:00 | Nation-State Threat Actors Renew Publications to npm | | North Korea |
| 2024-07-08T18:48:00+00:00 | New Tactics from a Familiar Threat (call-blockflow npm package) | | North Korean threat actors |
| 2024-07-31T20:24:00+00:00 | nebourhood npm packages (react-dom-production-script, hardhat-daemon) (in Q2 2024 Evolution of Software Supply Chain Security Report) | | North Korean state actors |
| 2024-10-31T20:07:44+00:00 | North Korean APT npm campaigns (in Q3 2024 Evolution of Software Supply Chain Security Report) | | North Korean Advanced Persistent Threat (APT) groups |
| 2024-11-20T20:03:41+00:00 | North Korean open-source ecosystem attacks (in 2025 Software Supply Chain Security Trends & Predictions) | | North Korea |
| 2024-07-15T00:00:00Z | Hunting Lazarus: Expanding Indicators with Historic DNS (meeting-themed phishing domains) | | Lazarus Group (APT38) |
| 2024-02-06T00:00:00.000Z | APT37 / ScarCruft profile (in "Beyond Headlines & Borders: An Overview of Advanced Threats") | South Korea; Japan; Russia; China; the Middle East | APT37; Ricochet Chollima; RubySleet; InkySquid; ScarCruft |
| 2024-02-28T00:00:00.000Z | Phishing by Appointment: Suspected North Korean Hackers Target Blockchain Community Via Telegram | | Lazarus Group (similar tactics) |
| 2024-03-05T00:00:00.000Z | Open Directory Exposes Phishing Campaign Targeting Google & Naver Credentials | | likely North Korean threat actor; Kimsuky (APT43, Black Banshee, Thallium) overlaps |
| 2024-06-25T00:00:00.000Z | XenoRAT linked to North Korean group (in "Good Game, Gone Bad: Xeno RAT Spread Via .gg Domains and GitHub") | | North Korean hacking group; Kimsuky |
| 2024-10-29T00:00:00.000Z | Suspected DPRK Phishing Campaign Targets Naver; Separate Apple Domain Spoofing Cluster Identified | South Korea | suspected North Korean-linked; Kimsuky-like |
| 2024-12-10T00:00:00.000Z | “Million OK!!!!” and the Naver Facade: Tracking Recent Suspected Kimsuky Infrastructure | South Korea | Kimsuky |
| 2024-11-19T00:00:00.000Z | UAT-5394 customized XenoRAT (mentioned in "XenoRAT Adopts Excel XLL Files and ConfuserEx") | | UAT-5394 (North Korean-linked actor) |
| Q1 2024 (from title: APT Quarterly Highlights : Q1 - 2024) | Lazarus exploitation of Windows kernel vulnerability to enhance FudModule rootkit; Kimsuky PyPI supply chain | APAC region | Lazarus Group; Kimsuky |
| Q2 2024 (from title: APT Quarterly Highlights : Q2 2024) | Moonstone Sleet, Lazarus Kaolin RAT and Kimsuky Gomir/ReconShark activity | South Korea | Kimsuky (Springtail); Moonstone Sleet (Storm-1789); Lazarus Group; Andariel |
| Q3 2024 (from title: APT QUARTERLY HIGHLIGHTS - Q3 2024) | Konni threat campaign against Korean and Russian government entities | South Korea; Russia | Konni (linked to Kimsuky) |
| 2024-06-25T15:14:00+00:00 | GrimResource MSC attack used by Kimsuky | Japan (signs of deployment) | Kimsuky APT group |
| 2024-09-24T14:42:41+00:00 | North Korean IT workers—or how not to solve the IT staff shortage | | North Korea (DPRK) IT workers |
| 2024-05-23T19:20:31Z | Beyond espionage — how the Lazarus Group is reshaping cybersecurity threats | | Lazarus Group (Hidden Cobra) |
| M-Trends 2024 (report year; no day-level date on PDF) | North Korean state-sponsored financially motivated intrusions (cryptocurrency theft and IT worker wage theft) | | likely North Korean state-sponsored attackers |
| M-Trends 2024 (report year; no day-level date on PDF) | APT43 profile | South Korea; United States | APT43 (North Korean Government) |
| M-Trends 2024 (report year; no day-level date on PDF) | Suspected DPRK Group Leverages SaaS Provider in a Targeted Supply Chain Attack | | Suspected DPRK group |