| 2026-04 | Drift Protocol | Australia | UNC4736 |
| 2025-09 | Seedify | Seychelles | Lazarus |
| 2025-09 | SBICrypto | Japan | Lazarus |
| 2025-08 | BtcTurk | Türkiye | Trader Traitor |
| 2025-08 | VCD Ransomware | | Scarcruft |
| 2025-07 | Woo X | United States | UNC4899 |
| 2025-07 | CoinDCX | India | Lazarus |
| 2025-07 | BigONE | Seychelles | Lazarus |
| 2025-06 | Favrr | Gibraltar | Famous Chollima |
| 2025-06 | ChainSaw | Australia | Famous Chollima |
| 2025-05 | BitoPro | Taiwan | Lazarus |
| 2025-05 | CJOliveNetworks | Korea, Republic of | Kimsuky |
| 2025-03 | Zoth | Panama | Lazarus |
| 2025-02 | Bybit | United Arab Emirates | Lazarus |
| 2025-02 | Somansa | Korea, Republic of | Andariel |
| 2025-01 | Phemex | Singapore | |
| published 2025-12-04 | Upbit hot wallet breach | South Korea | a North Korean group like the Lazarus Group (believed) |
| 2025/10/23 | Gotta fly: Lazarus targets the UAV sector | | |
| April 2025 | CSIS entry 71 | | |
| February 2025 | CSIS entry 74 | | |
| 2025-02 | Operation “DEEP#DRIVE” | | Kimsuky, Velvet Chollima |
| 2025-02 | Phishing Email Attacks by the Larva-24005 Group Targeting Japan | | Kimsuky, Velvet Chollima |
| 2025-01 | Operation “99” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-01 | Operation “Phantom Circuit” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-01 | Operation “Marstech Mayhem” | | Lazarus Group, Hidden Cobra, Labyrinth Chollima |
| 2025-03 | Operation “ToyBox Story” | | Reaper, APT 37, Ricochet Chollima, ScarCruft |
| 2025-01-09 | Crypto Staker Theft | | |
| 2025-01-20 | Unknown Jan 2025 | | |
| 2025-01-26 | Dimitra Token | | |
| 2025-02-05 | Russell | | |
| 2025-02-05 | Unknown Feb 2025 | | |
| 2025-02-15 | Misc CI Thefts | | |
| 2025-02-17 | Ripio | | |
| 2025-02-18 | Individual 0xpeet | | |
| 2025-02-28 | Founder/CEO of A6 | | |
| 2025-02-28 | Fantom Reuse Address | | |
| 2025-03-07 | Founder/CEO of B3 | | |
| 2025-03-14 | Huge March 2025 Theft | | |
| 2025-04-14 | Atlos | | |
| 2025-04-23 | Oxya Admin Key Mint | | |
| 2025-04-23 | April 2025 Theft | | |
| 2025-04-25 | Malicious Du-store Repo | | |
| 2025-04-29 | Malicious BbaudConferenceDV Repo | | |
| 2025-05-16 | Unknown JUP Holder | | |
| 2025-05-19 | MarketAcross | | |
| 2025-05-20 | Individual M6 | | |
| 2025-05-24 | TAO Founder | | |
| 2025-06-03 | SpaceM | | |
| 2025-06-12 | Medhi | | |
| 2025-06-12 | June 12 2025 Theft | | |
| 2025-06-14 | Clober | | |
| 2025-06-19 | Bunzz | | |
| 2025-06-21 | June 21 2025 Theft | | |
| 2025-06-22 | Hacken HAI Token Mint | | |
| 2025-06-22 | Sololabs | | |
| 2025-06-26 | June 26 2025 Theft | | |
| 2025-06-27 | Noya AI | | |
| 2025-06-29 | VALR API Key Trade Extraction | | |
| 2025-06-30 | June 30 2025 Theft | | |
| 2025-07-04 | Individual DD | | |
| 2025-07-10 | Malicious Store-V Repo | | |
| 2025-07-17 | Open Fabric | | |
| 2025-07-23 | Malicious Blackbaud Moon Monkey Repo | | |
| 2025-08-06 | Aug 2025 Theft from Individual | | |
| 2025-08-08 | Newfuture | | |
| 2025-08-11 | Unknown Canadian Victim | | |
| 2025-08-13 | Rena | | |
| 2025-08-14 | AreonX | | |
| 2025-09-01 | OlaXBT | | |
| 2025-09-01 | Venus Whale | | |
| 2025-09-03 | Wolf on Sol | | |
| 2025-09-06 | Unknown Sep 6 2025 Theft | | |
| 2025-09-06 | Individual AN5 | | |
| 2025-09-09 | JP Thor | | |
| 2025-09-10 | Request / Singularity | | |
| 2025-09-11 | Shibarium | | |
| 2025-09-12 | Sep 12 Theft | | |
| 2025-09-19 | Ross Gates | | |
| 2025-09-19 | Sep 19 Theft | | |
| 2025-09-22 | UXLINK | | |
| 2025-09-27 | September 27 2025 Theft | | |
| 2025-09-29 | September 29 2025 Theft | | |
| 2025-10-01 | October 1 2025 Theft | | |
| 2025-10-18 | Unknown Oct 18 2025 Theft | | |
| 2025-10-20 | MetaMask Horse | | |
| 2025-10-21 | YourCryptoFren | | |
| 2025-10-27 | Capital DAO | | |
| 2025-10-30 | Garden Finance | | |
| 2025-10-31 | Individual Laura66 | | |
| 2025-11-03 | Proph3ttt | | |
| 2025-12-08 | December 8 2025 | | |
| 2025-12-09 | Fake Ken Theft | | |
| 2025-12-10 | December 10 2025 (Overlaps JUP) | | |
| 2025-12-11 | December 10 2025 (Overlaps Sololabs) | | |
| 2025-12-13 | Fake Teams Meet | | |
| 2025-12-16 | Fake Lionel Theft | | |
| 2025-12-22 | Unknown Dec 22 Theft | | |
| 2025-03-14 | Henlo Kart | | DPRK IT Workers |
| 2025-09-09 | SwissBord | | DPRK (Unidentified) |
| 2025-01-23 (press release date) | Two North Korean Nationals and Three Facilitators Indicted for Multi-Year Fraudulent Remote Information Technology Worker Scheme that Generated Revenue for the Democratic People’s Republic of Korea | | |
| 2025-02-11 (press release date) | Arizona Woman Pleads Guilty in Fraud Scheme That Illegally Generated $17 Million in Revenue for North Korea | | |
| 2025-06-30 (press release date) | Justice Department Announces Coordinated, Nationwide Actions to Combat North Korean Remote Information Technology Workers’ Illicit Revenue Generation Schemes | | |
| 2025-06-30 (press release date) | Four North Koreans Charged in Nearly $1 Million Cryptocurrency Theft Scheme | | |
| 2025-06-30 (press release date) | Nine Charged with Alleged Scheme to Generate Revenue for North Korean Government and Its Weapons of Mass Destruction Program | | |
| 2025-11-13 (press release date) | Ukrainian Pleads Guilty in DC in Laptop Farm Scheme That Generated Income for North Korean IT Workers | | |
| 2025-11-14 (press release date) | Justice Department Announces Nationwide Actions to Combat Illicit North Korean Government Revenue Generation | | |
| 令和７年 (2025) | North Korean APT groups: targeted emails against individuals, building impersonation infrastructure, SNS initial compromise of crypto-business employees | Japan | 北朝鮮のＡＰＴ攻撃グループ |
| (Annual Review 2025) | DPRK IT workers targeting UK firms; UK-based cryptoasset firms at risk from DPRK-linked hackers | United Kingdom | DPRK threat actors; DPRK-linked hackers |
| last year (speech delivered 7 May 2025) | North Korea cryptocurrency theft total for the previous year | | North Korea ("it is thought") |
| (reported 2025) | North Korean cyber attacks on German high-tech and defence sector and on crypto-sector individuals and companies in Germany | Germany | Nordkorea; RGB (wahrscheinlich verantwortlich für Lazarus) |
| (reported 2025) | North Korean IT workers employed by German companies | Germany | Nordkorea (getarnte IT-Fachkräfte) |
| 06 November 2025 (sanctions date) | Australian sanctions on four entities and one individual engaged in cybercrime for North Korea | | North Korea |
| During the year (2025/26) | North Korean IT worker employed remotely by a large New Zealand business using false persona and NZ citizen laptop operator | New Zealand | North Korean worker (DPRK) |
| in 2025 | Cyber attacks on Dutch companies and persons by or with help of North Korean IT workers, mainly to steal cryptocurrency | Netherlands | Noord-Koreaanse IT’ers |
| in 2025 | FIOD/BKA/Europol/zeroShadow takedown of server network in Germany used to launder crypto stolen by North Korea; €34 miljoen seized | Germany | Noord-Korea |
| en 2025 | Moonstone Sleet reportedly used to deploy Qilin RaaS in a limited number of attacks | | MOA réputé lié à la Corée du Nord Moonstone Sleet |
| October 2025 | Slack chat groups of North Korean IT workers: collection officer specifying crypto addresses | | North Korean IT workers |
| March 2025 | North Korean IT worker arrested in China for allegedly stealing Chinese military technology information | China | a North Korean IT worker |
| 2025-10-16T10:00:49.000Z | BeaverTail and OtterCookie evolve with a new Javascript module | | |
| In recent months (as of 2025-01-23) | IT workers extorting employers with stolen data and code | United States | North Korean IT workers |
| 2025-06-23 | 23rd June – Threat Intelligence Report | | |
| 2025-08-25 | 25th August – Threat Intelligence Report | | |
| From around December 2025 through July 2026 | WaterPlum / Contagious Interview fake job-interview malware campaign (30,000 PCs, 100+ countries) | | WaterPlum ("Contagious Interview") |
| November 25 2025 (dateCreated 2025-11-25) | FlexibleFerret: macOS Malware Deploys in Fake Job Scams | | DPRK-aligned operators |
| August 18, 2025 | The Coordinated Embassy Hunt: Unmasking the DPRK-linked GitHub C2 Espionage Campaign | | DPRK-linked actors; Kimsuky |
| February 2025 | ByBit hack proceeds laundered through Target Address #4 controlled by Professional Money Laundering Organizations | | "TraderTraitor" campaign waged by the Democratic People's Republic of Korea |
| Oct 6, 2025 | 2025 DPRK-linked thefts incl. Bybit, LND.fi, WOO X, Seedify | | North Korea-linked hackers |
| published 2025-12-18 | DPRK crypto theft in 2025 (annual total) | | North Korean hackers / DPRK |
| published 2025-12-18 | North Korean crypto theft in 2025 and 2023 marquee hacks (Atomic Wallet, CoinsPaid, Alphapo, Stake.com, CoinEx) | | North Korea |
| 2025-06-05 | IT workers at blockchain development companies; $7.74 million frozen | | North Korean IT workers; Sim Hyon Sop; Kim Sang Man (Chinyong) |
| 2025-09-25 (article) | At least 25 instances of North Korean IT workers infiltrating crypto companies to steal funds or extort; five IT workers with 30+ fake identities; Blocknovas LLC and Softglide LLC fronts | | DPRK IT workers (ZachXBT) |
| Jul 2 (year 2025 inferred from thread text 'since January 1, 2025'; page shows 'Jul 2') | ZachXBT: payments to North Korean IT workers hired as developers since January 1, 2025 | | DPRK IT workers |
| published 2025-04-01 (Q1 2025) | Bybit and Phemex hacks | | North Korean Lazarus Group (suspected) |
| 2025-07-24 | Korea Sobaeksu Trading Company IT worker teams (incl. Vietnam) | Vietnam | Korea Sobaeksu Trading Company; Munitions Industry Department; Kim Se Un; Jo Kyong Hun; Myong Chol Min |
| Over the past three years (as of November 4, 2025) | DPRK-affiliated cyber theft total | | North Korea-affiliated cybercriminals |
| 2025-11-04 | Funds managed for First Credit Bank linked to a DPRK ransomware actor and IT worker revenue | | Jang Kuk Chol; Ho Jong Son; First Credit Bank |
| 2025-12-04 | Vong scheme: Doe likely a North Korean national | | John Doe aka William James |
| March 2025 | FBI seizure of USDT from APT38 actors (forfeiture complaints) | | APT38 |
| In May 2025 | Suspected North Korean IT worker application to a Japanese cryptocurrency exchange (not hired) | Japan | suspected North Korean IT worker |
| As of 2025 | Kimsuky "quishing" (malicious QR code) spearphishing against think tanks, academia, governments | | Kimsuky |
| In May 2025 | Spoofed foreign advisor email to a think tank leader with QR code | | Kimsuky |
| Later that month (May 2025) | Spoofed embassy employee email to a think tank senior fellow (North Korean human rights) | | Kimsuky |
| Also in May 2025 | Spoofed think tank employee email with QR code to Kimsuky infrastructure | | Kimsuky |
| In June 2025 | Fake conference invitation to a strategic advisory firm leading to fake Google login | | Kimsuky |
| 2025-07-23 | IT workers using witting and unwitting U.S.-based facilitators | United States | North Korean IT workers |
| August 27, 2025 | North Korean IT workers involved in malicious cyber activities, particularly in the blockchain industry | | North Korean IT workers |
| 2025-01-23 | Andariel 공격 그룹이 활용하는 RID Hijacking 공격 기법 | | Andariel |
| 2025-01-28T00:00:00.000Z | Suspected DPRK Campaign Persists with SparkRAT Activity (in "Unmasking SparkRAT") | South Korea (server hosted in Seoul) | suspected DPRK |
| 2025-02-03T20:13:32.000Z | macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed | SentinelOne | | |
| 2025-02-04 | RDP Wrapper를 활용한 Kimsuky 그룹의 지속적인 위협 | | Kimsuky |
| 2025-02-03 | K 메신저로 유포된 'APT37' 그룹의 악성 HWP 사례 분석 | | APT37 |
| 05/02/2025 | Multiple Organizations | >1 | Lazarus Group |
| 11/02/2025 | Individuals that work in international affairs organizations, NGOs, government agencies, and media companies across North America, South America, Europe, and East Asia. | >1 | Kimsuky (aka Emerald Sleet or Velvet Chollima |
| February 13, 2025 | PurpleBravo (Contagious Interview) targeting of cryptocurrency entities (October-November 2024) | United Arab Emirates | PurpleBravo (formerly TAG-120) |
| 19/02/2025 | It Workers at Western Companies | >1 | North Korea's cyber-espionage campaign, "Contagious Interview." |
| 2025/02/20 | DeceptiveDevelopment targets freelance developers | | |
| 2025-10-02 | Larva-25010 – APT Down 공격자 PC 분석 | | Kimsuky; Larva-25010 |
| 2025년 하반기 | North Korean hackers add 197 malicious npm packages targeting developers (Dec 2025) | | |
| 2025년 (2026 국가정보보호백서) | North Korea: Bybit theft (Feb 2025) and impersonation of defense-company and headhunter recruiters | | |
| 2025년 (2026 국가정보보호백서) | NIS finds North Korea hacked defense and energy firms through IT-solution flaws (early 2025) | | |
| 2025-02-13 | 北 해킹 조직, 거래처 업무 메일로 위장한 스피어 피싱 공격 주의! | | KONNI; Kimsuky; Konni; Lazarus; Thallium; 김수키; 라자루스 |
| 2025-11-17 | 北 해커, JSON 저장소 악용해 개발자 노린 정교한 악성코드 공격 포착 | | Contagious Interview |
| 2025-01-24 | 계정정보 탈취를 시도하는 피싱 공격 진행 중! 북 배후 추정 | | Kimsuky; 김수키 |
| 2025-08-07 | 北 해킹 조직의 언론사 위장 스피어 피싱 공격 주의! | | Kimsuky; 김수키 |
| 2025-11-28 | .hta 파일로 유포중인 KimJongRAT 주의! | | KimJongRAT; Kimsuky |
| 2025-03-07 | Kimsuky 그룹의 워터링 홀 공격, 통일 분야 교육 지원서를 위장한 악성 파일 유포 주의 | | Kimsuky; 김수키 |
| 2025-02-12 | 2025년 1월 APT 그룹 동향 보고서 | | Andariel |
| 2025-03-05 | Lazarus 그룹의 윈도우 웹 서버 대상 공격 사례 분석 | | Lazarus |
| 2025-04-02 | 채용 메일을 위장한 피싱 공격 정황 사례 분석 (BeaverTail, Tropidoor) | | Lazarus |
| 2025-04-14 | APT그룹 추적 보고서 – Larva-24005 | | Kimsuky; Larva-24005 |
| 2025-04-15 | MS 정상 유틸리티 mavinject.exe를 이용한 인젝션 공격 사례 | | Lazarus |
| 2025-04-16 | 2025년 3월 APT 그룹 동향 보고서 | | KONNI; Kimsuky; Konni; Lazarus |
| 2025-04-22 | 2025년 3월 PebbleDash 악성코드 유포 사례 | | Kimsuky; Lazarus |
| 2025-05-16 | 2025년 4월 APT 그룹 동향 보고서 | | KONNI; Konni; Lazarus |
| 2025-05-22 | Larva-25004 (Kimsuky 연관) 그룹의 추가 인증서 악용 사례 – Nexaweb 인증서로 서명된 악성코드 | | Kimsuky; Larva-25004 |
| 2025-06-12 | 2025년 5월 APT 그룹 동향 보고서 | | APT37; KONNI; Konni; TA-RedAnt |
| 2025-06-12 | 논문파일을 위장한 악성코드 유포 주의 (Kimsuky 그룹) | | Kimsuky |
| 2025-07-15 | 2025년 6월 APT 그룹 동향 보고서 | | Kimsuky |
| 2025-08-22 | 2025년 7월 APT 그룹 동향 보고서 | | Kimsuky; Lazarus |
| 2025-09-11 | 2025년 8월 APT 그룹 동향 보고서 | | APT43; Kimsuky; Lazarus |
| 2025-10-21 | 2025년 9월 APT 그룹 동향 보고서 | | APT37; Kimsuky; Lazarus; TA-RedAnt |
| 2025-11-13 | 2025년 10월 APT 그룹 동향 보고서 | | Kimsuky; Larva-25004; Lazarus |
| 2025-12-12 | 2025년 11월 APT 그룹 동향 보고서 | | KONNI; Kimsuky; Konni; Lazarus; TA-RedAnt |
| 2025-11-09 | 국가 배후 위협 조직의 안드로이드 디바이스 대상 원격 초기화 전술 | | APT37; KONNI; Kimsuky; Konni; 김수키; 코니 |
| 2025-03-04 | 비상계엄 테마 APT 공격과 Kimsuky 그룹 연관성 분석 | | APT37; Kimsuky; 김수키 |
| 2025-12-21 | 작전명 아르테미스: HWP 기반 DLL 사이드 로딩 공격 분석 | | APT37 |
| 2025-04-01 | 경찰청과 국가인권위를 사칭한 Konni APT 캠페인 분석 | | KONNI; Konni; 코니 |
| 2025-08-03 | RoKRAT 셸코드 및 스테가노그래피 기반 위협 분석과 EDR 대응 방안 | | APT37 |
| 2025-07-01 | '클릭픽스' 전술을 활용한 김수키 그룹 위협 사례 분석 | | Kimsuky; 김수키 |
| 2025-06-09 | 김수키 그룹의 3단 콤보 위협 분석 | | Kimsuky; 김수키; 북한연계 |
| 2025-03-06 | 소프트웨어 공급망 보안 취약점 노린 해킹 [기사: 국정원, 소프트웨어 공급망 보안 취약점 노린 북한 해킹 경고] | | 북한 해킹 조직 |
| 2025-10-22 | 다국적제재모니터링팀(MSMT), 북한 불법 사이버 활동 관련 보고서 발간 | | 북한 |
| 2025-08-07 | ScarCruft’s New Language: Whispering in PubNub, Crafting Backdoor in Rust, Striking with Ransomware | | ChinopuNK; ScarCruft |
| 2025.05.26. | 북한 해커와 연계된 도박사이트 사건 수사결과 | | 북한 313총국; 정찰총국 소속 해커 |
| 2025-02-16 | 北 라자루스, 특정 표적 ‘핀셋’ 타격 | | Lazarus; 라자루스 |
| 2025-04-24T05:00:04 | Operation SyncHole: Lazarus APT goes back to the well | | |
| 2025-09-02 | 북한 APT37, 한국 정부·정보기관 대상 정교한 스피어피싱 공격 전개 | | APT37; ScarCruft; Reaper |
| 2025-10-31 | 북한, 2·3분기 국가 배후 해킹에서 전 세계 압도적 1위…‘라자루스’ 앞세워 공격 수위 높여 | | 라자루스; 김수키; 안다리엘 |
| 2025-01-14 | North Korea’s Lazarus Group behind $235 million WazirX hack, confirms joint statement by US, South Korea, Japan | | Lazarus |
| 2025-12-01 | Эксперты убеждены, что в 2026 году северокорейские хакеры ус | | Lazarus |
| 2025-03-28 | Digital warfare: N. Korea's evolving cyber arsenal and global threats | | |
| 2025-01-31 | 北 해커부대 라자루스, 오픈소스 프로젝트 복제해 백도어 유포…대규모 공급망 공격 감행 | | Lazarus; 라자루스 |
| 2025-02-06 | 북한 라자루스 해킹그룹, 가짜 링크드인 채용 사기로 OS 감염 악성코드 유포 | | Lazarus; 라자루스 |
| 2025-10-30T20:03:36Z | Kimsuky HttpTroy (invoice-themed VPN dropper) intrusion | KR | Kimsuky (possible) |
| 2025-12-18 | “CJ대한통운 사칭” QR 피싱으로 안드로이드 RAT 설치…북한 김수키, DocSwap 변종 유포 정황 | | Kimsuky; 김수키 |
| 2025-09-15 | 북한 김수키, AI 딥페이크로 군 공격 시도 | | 김수키 |
| 2025-11-30 | 라자루스부터 안다리엘까지…북한 3대 해킹조직 어떻게 침투했나 | | Lazarus; 라자루스; Kimsuky; 김수키; Andariel; 안다리엘 |
| 2025-03-10 | “가상자산 2조원 탈취 北해커 조직, 최소 4000억원 현금화” | | 라자루스 |
| 2025-02-25 | 업비트에 바이비트까지…라자루스 그룹, 산업의 판도를 흔들다 [블록렌즈] | | 라자루스 |
| 2025-11-30 | '한국' 타켓 삼은 북한 해킹조직 라자루스·김수키 | | 라자루스; 김수키 |
| 2025-08-18 | Kuzey Koreli Hacker Grubu Lazarus Yine Sahnede: İngiliz Kripto Para Borsasını Tarihe Gömdü | | Lazarus |
| 2025-05-23 | 他是朝鲜最牛的黑客：团队规模超千人，短短两天，盗窃近15亿美元 | | Lazarus |
| 2025-05-26 | Хакеры из Северной Кореи | | Lazarus |
| 2025-03-10T22:59:28.808Z | Lazarus Strikes npm Again with New Wave of Malicious Packages | | |
| 2025-01-30 | [VOA 뉴스] 북한 해킹조직 탈취 ‘가상 자산’…‘소유권 청구서’ 공고 | | 라자루스 |
| 2025-10-19 | 韓 기업 노리는 '그 놈들'…랜섬웨어, 더 강해진다 | | Kimsuky; 김수키 |
| early 2025 | Takeover of the email account of an India-based cryptocurrency gaming company’s CEO; spear phishing of over 250 individuals | India | CryptoCore |
| February 2025 | ClickFake Interview campaign (ClickFix tactic; GolangGhost, FrostyFerret) | | DPRK cyber actors (Lazarus, per Sekoia source title) |
| since at least February 2025 | Qilin ransomware deployments, including a U.S. healthcare provider | United States | Moonstone Sleet (affiliate of Qilin) |
| February 2025 (OpenAI report); 2025 (DeepSeek) | Use of OpenAI tools, ChatGPT and DeepSeek | | CryptoCore; TraderTraitor |
| 2025 | Ryugyong Technology IT workers holding jobs at more than eight companies under false personas | United States; Canada; India; Netherlands; Ireland (employer locations) | DPRK Ryugyong Technology Company (75 Guidance Bureau, MID) |
| mid-2025 | Umnal IT worker Choe Il-kuk (persona “Naoki Murano”) possibly connected to Wagemole and Contagious Interview | Russian Federation (Vladivostok) | Umnal delegation (Chinyong IT) |
| January 2025 | Chonsurim IT worker employed by an international DeFi company | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| February 2025 | Chonsurim IT worker developing a payment gateway for a commercial website | | Chonsurim Trading Corporation IT workers (Laos; Department 53, Ministry of National Defense) |
| over a three-year period, as recently as early 2025 | Argentina-based facilitator Antonia Doroganova’s Payoneer accounts for DPRK IT workers | Argentina | facilitator for Amnokgang and Ryugyong IT workers |
| 2025 | Japan case 5: individuals assisting North Korean IT workers | Japan | North Korean IT workers / North Korea-affiliated IT companies in China |
| March and April 2025 | Registration of fake video conferencing domains for spear phishing (e.g. web001-zoom.us, zoomsdk.us, secure-meeting.cloud) | | CryptoCore |
| 2025-06-30T19:17:49+00:00 (published_time) | Jasper Sleet North Korean remote IT workers using AI; 3,000 Microsoft consumer accounts suspended | United States (US) companies; globally | Jasper Sleet (formerly Storm-0287); also Storm-1877 and Moonstone Sleet |
| 2025-10-16T14:06:28+00:00 (published_time) | Microsoft Digital Defense Report 2025 summary: North Korean remote IT workers and extortion | companies around the world | North Korean remote IT workers |
| Microsoft Digital Defense Report 2025 | North Korean remote IT workers embedded at organizations worldwide | around the world; US-based companies | North Korean IT workers (Jasper Sleet) |
| Microsoft Digital Defense Report 2025 | North Korean actor participating as a ransomware-as-a-service (RaaS) affiliate for the first time | | a North Korean actor (not named in this passage) |
| Microsoft Digital Defense Report 2025 | North Korean targeting focus: IT sector, banking/blockchain, defense, manufacturing; South Korea in APAC | South Korea | North Korean threat actors |
| 2025-02-12 (datePublished) | APT38 thefts from financial institutions incl. SWIFT compromises | worldwide | APT38 |
| 2025-02-12 (datePublished) | TraderTraitor theft from a Japan-based company (as reported in December 2024 FBI/DC3/NPA statement) | Japan-based | UNC4899 (TraderTraitor) |
| 2025-02-12 (datePublished) | UNC3782 cryptocurrency crime and targeting of South Korean organizations combating crypto crime | South Korean | UNC3782 (suspected North Korean) |
| 2025-02-12 (datePublished) | North Korean cryptocurrency theft 2017-2023 (UN estimate cited) | | North Korea |
| 2025-03-06 (datePublished) | North Korean IT workers: global expansion, extortion and data leak operations | U.S.; Europe and Asia | North Korean IT workers |
| 2025-04-01 (datePublished) | DPRK IT worker operations expanding to Europe (one worker with 12 personas targeting defense and government) | Europe and the United States; United Kingdom; Germany and Portugal | DPRK IT workers |
| 2025-04-01 (datePublished) | DPRK IT worker extortion attempts against larger organizations (since late October 2024) | | DPRK IT workers |
| Cloud Threat Horizons Report H2 2025 (no exact date on page) | UNC4899 social-engineering intrusions into Google Cloud and AWS environments leading to cryptocurrency theft (Q3 2024 to Q1 2025) | | UNC4899 (TraderTraitor) |
| 2025-10-16 (datePublished) | UNC5342 EtherHiding (JADESNOW / INVISIBLEFERRET) in Contagious Interview campaign | | UNC5342 |
| 2025-11-05 (datePublished) | UNC1069 (MASAN) misuse of Gemini and deepfake lures distributing BIGMACHO | | UNC1069 (aka MASAN) |
| 2025-11-05 (datePublished) | UNC4899 (PUKCHONG) misuse of Gemini | | UNC4899 (aka PUKCHONG) |
| February 27, 2025 | FAMOUS CHOLLIMA incidents in 2024 (2025 Global Threat Report) | | FAMOUS CHOLLIMA |
| August 04, 2025 | FAMOUS CHOLLIMA GenAI-enabled infiltration of over 320 companies (2025 Threat Hunting Report) | | FAMOUS CHOLLIMA |
| 2025-11-03T06:00Z (datePublished) | DPRK-nexus targeting of European defense, diplomatic, and financial institutions (2025 European Threat Landscape Report) | European | DPRK-nexus actors |
| February 13, 2025 | North Korea-linked front companies in China spoofing legitimate IT firms (TAG-121) | China; spoofed firms in China, India, Pakistan, Ukraine, and the United States | TAG-121 |
| November 12, 2025 | PurpleDelta (North Korean IT workers) applications to over 1,100 companies (late 2024 to early 2025) | operators likely based in China | PurpleDelta |
| April 17, 2025 | TA427 ClickFix campaign against think tanks; Japanese diplomat impersonation (January-February 2025) | Washington, DC; South Korea (infrastructure) | TA427 (Kimsuky / Emerald Sleet) |
| May 13, 2025 | TA406 phishing and malware against Ukrainian government entities (February 2025) | Ukraine; Russia (historical) | TA406 (Opal Sleet, Konni) |
| 2025-10-28T03:00:11 | Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs | | |
| 2025-04-21T03:00:56 | False Face: Unit 42 Demonstrates the Alarming Ease of Synthetic Identity Creation | | |
| 2025-02-26T03:00:59 | RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector | | |
| 2025-09-04T09:55:04.000Z | Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms | SentinelOne | | |
| 2025-07-02T09:55:37.000Z | macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware | SentinelOne | | |
| 2025-04-23 | Russian Infrastructure Plays Crucial Role in North Korean Cybercrime Operations | | |
| 2025-09-08 | APT37: Rust Backdoor & Python Loader | ThreatLabz | | |
| 2025-07-03T05:00:00.000Z | 3CX’s Software Supply Chain Compromise: Lessons Learned | RL Blog | | |
| 2025/09/25 | DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception | | |
| 2025/11/06 | ESET APT Activity Report Q2 2025–Q3 2025 (DPRK-related paragraph 1) | | |
| 2025/05/19 | ESET APT Activity Report Q4 2024–Q1 2025 (DPRK-related paragraph 1) | | |
| 2025/05/19 | ESET APT Activity Report Q4 2024–Q1 2025 (DPRK-related paragraph 2) | | |
| 2025-06-18T01:50:57.000Z | Analysis of the recent Endoor malware of Kimsuky (APT-Q-2) group | | |
| 2025-04-11T09:00:50.000Z | Suspected Kimsuky (APT-Q-2) attacks South Korean companies | | |
| 2025-08-28T08:19:06.000Z | The Trap of Troubleshooting: Analysis of Lazarus (APT-Q-1)'s Recent Attacks Using ClickFix | | |
| 2025-07-14T21:43:41.794Z | Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader | | |
| 2025-04-04T12:25:43.627Z | Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads | | |
| 2025-10-10T17:13:22.383Z | North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads | | |
| 2025-11-26T20:13:53.254Z | Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks | | |
| 2025-01-29T22:47:16.420Z | North Korean APT Lazarus Targets Developers with Malicious npm Package | | |
| 2025-06-25T01:10:19.162Z | Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages | | |
| 2025-05-14T16:44:07.782Z | BeaverTail / InvisibleFerret multi-stage npm campaign (in 2025 Mid-Year Threat Report) | | North Korean threat actors |
| 2025-06-12T13:47:04.870Z | Contagious Interview campaign (in 2025 Blockchain and Cryptocurrency Threat Report) | | North Korea |
| 2025-09-17T17:07:11.749Z | Identifying and Preventing Fraudulent Engineering Candidates: An Investigation into 80 Confirmed Cases | | suspected North Korean operators |
| 2025-10-16T21:22:16.651Z | Lazarus npm packages (cited in ENISA 2025 Threat Landscape) | | Lazarus Group |
| 2025-09-09T15:00:00.000Z | Contagious Interview / Ferret macOS malware (in "Ransomware 2025: Infostealers on the March") | | North Korea |
| 2025-01-24T00:00:00Z | Tenacious Pungsan npm campaign (in Datadog threat roundup Q4 2024) | | Tenacious Pungsan |
| 2025-10-31T00:00:00Z | Fraudulent North Korean IT workers (in Datadog threat roundup Q3 2025) | United States | fraudulent North Korean IT workers |
| Mar 31, 2025 | ByBit theft (mentioned in "Malware hiding in plain sight") | | Lazarus |
| Jun 12, 2025 | North Korean Crypto-Heist Targets Web3 Developers via Malicious NPM Package (web3-wrapper-ethers) | | Void Dokkaebi |
| 2025-04-09T15:45:00+00:00 | Resurgent North Korean Malware Campaign in npm | | North Korean attackers |
| 2025-07-31T15:33:36+00:00 | North Korean Crypto Stealing Campaign Rears Its Head Again | | North Korean |
| 2025-12-11T16:33:55+00:00 | Contagious Interview (in Threat Research Year In Review - 2025) | | Famous Chollima |
| February 25, 2025 | Silent Push Pivots into New Lazarus Group Infrastructure, Acquires Sensitive Intel Related to $1.4B ByBit Hack and Past Attacks | | Lazarus Advanced Persistent Threat (APT) Group |
| February 28, 2025 | Astrill VPN: Silent Push Publicly Releases New IPs on VPN Service Heavily Used by North Korean Threat Actors | | Lazarus; Contagious Interview (Famous Chollima) |
| April 24, 2025 | Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware: BeaverTail, InvisibleFerret, and OtterCookie | | Contagious Interview (Famous Chollima); Lazarus |
| 2025-01-16T00:00:00Z | Lazarus APT: Techniques for Hunting Contagious Interview (ClickFix fake video job interviews) | | Lazarus APT |
| 2025-06-18T05:00:00.000Z | Inside the BlueNoroff Web3 macOS Intrusion Analysis (Feeling Blue(Noroff)) | | TA444 aka BlueNoroff, Sapphire Sleet, COPERNICIUM, STARDUST CHOLLIMA, CageyChameleon |
| 2025-07-22T00:00:00Z | Previously unreported domain associated with TraderTraitor Bybit activity (in "Substantial Upgrades to Crawling History") | | Lazarus Group (TraderTraitor) |
| 2025-11-20T00:00:00Z | Inside DPRK’s Fake Job Platform Targeting U.S. AI Talent (lenvny[.]com) | U.S. | DPRK-linked Contagious Interview operation |
| 2025-01-14T00:00:00.000Z | ‘JustJoin’ Landing Page Linked to Suspected DPRK Activity Resurfaces | | TA444/BlueNoroff |
| 2025-12-17T00:00:00.000Z | Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns (with Acronis TRU) | | Lazarus; Kimsuky; Lazarus DeceptiveDevelopment cluster |
| 2025-06-30 | Uncovering DPRK Remote Workers: Detecting Hidden Threats Through Internet Telemetry | | DPRK operatives; North Korean IT contractors |
| 2025-07-08T10:00:00.000Z | Lazarus Group packages in npm and PyPI (in Q2 2025 Open Source Malware Index) | | Lazarus Group |
| 2025-07-30T10:00:00.000Z | Global Espionage: Lazarus Group Targets OSS Ecosystems | | Lazarus Group |
| 2025-08-27T14:00:00.000Z | North Korean IT operatives infiltrate 320+ companies (CrowdStrike report cited in "AI and Malware: Infiltrating Software Development Teams") | | Famous Chollima; North Korean IT operatives |
| 2025-06-30T05:00:00.000Z | Fake IT worker deepfake scams linked to North Korea, incl. Kraken targeted (in Tradecraft Tuesday recap "AI: Friend or Faux") | | threat actors linked to North Korea |
| 2025-09-18T05:00:00.000Z | North Korean IT worker schemes (in "How Malicious Hackers Try to Infiltrate Your IT Team") | China; Russia (where operatives often work from); US (identities) | North Korean IT workers |
| 2025-10-30T20:03:36Z | Lazarus Comebacker to BLINDINGCAN variant intrusion | CA | Lazarus |
| 2025-05-15T03:00:00+00:00 | North Korean OtterCookie is back (fourth version) | | WaterPlum (rebranding of Famous Chollima); Contagious Interviews campaign |
| 2025-09-01T13:00:00+00:00 | Three Lazarus RATs coming for your cheese (PondRAT, ThemeForestRAT, RemotePE incident response cases) | | Lazarus subgroup (AppleJeus, Citrine Sleet, UNC4736, Gleaming Pisces) |
| 2025-04 (from URL path; no date on page) | How AI services power the DPRK’s IT contracting scams | | DPRK IT Workers; Wagemole |
| 2025-05-08T08:01:07.000Z | Additional Features of OtterCookie Malware Used by WaterPlum | | WaterPlum (Famous Chollima, PurpleBravo) |
| M-Trends 2025 (report year; no day-level date on PDF) | North Korean IT workers as insider threat (UNC5267), 5% of initial infection vectors in 2024 | | UNC5267 (North Korean IT workers) |
| M-Trends 2025 (report year; no day-level date on PDF) | APT45 profile | | APT45 (DPRK) |
| M-Trends 2025 (report year; no day-level date on PDF) | DPRK IT workers placed outside North Korea as remote IT contractors (UNC5267) | Western countries | UNC5267 (DPRK) |