| 2026-09 | Bitget | Seychelles | Trader Traitor |
| 2026-08 | BindsNET | | Polin Rider |
| 2026-08 | arrayref | | Sapphire Sleet |
| 2026-07 | DoubleBarrel | Korea, Republic of | Lazarus |
| 2026-07 | Joyfill | United States | Polin Rider |
| 2026-07 | AFX Bridge | United Kingdom | UNC4899 |
| 2026-07 | ORO | | Sapphire Sleet |
| 2026-06 | Mastra | United States | Sapphire Sleet |
| 2026-06 | Humanity Protocol | Hong Kong | |
| 2026-04 | LeenLee Country Club | Korea, Republic of | Lazarus |
| 2026-04 | KelpDAO / LayerZero | India | Trader Traitor |
| 2026-04 | Endpoint(Midnight) Ransomware | Korea, Republic of | |
| 2026-04 | Zerion | United States | UNC1069 |
| 2026-03 | Axios | | Bluenoroff |
| 2026-03 | Rook Ransomware | Korea, Republic of | Andariel |
| 2026-03 | Neutralinojs | Sri Lanka | Polin Rider |
| 2026-03 | Bitrefill | Sweden | Bluenoroff |
| 24 Feb 2026 | North Korean Lazarus Group Now Working With Medusa Ransomware | | |
| 2026-01 | Step Finance | Spain | |
| 2026-01-01 | Tenexium | | |
| 2026-01-06 | Thefts via VSCode runOn: folderOpen | | |
| 2026-01-08 | Fake Survicate (Willo-esque) | | |
| 2026-01-13 | Fake Teams Jan 2026 | | |
| 2026-01-26 | Misc Contagious Shit | | |
| 2026-01-28 | Unknown Jan 28 2026 | | |
| 2026-02-02 | Fake Sally Feb 2026 | | |
| 2026-02-11 | Rage Guy Theft | | |
| 2026-02-12 | Unknown Feb 12 2026 | | |
| 2026-02-26 | Unknown IT Worker Related Theft | | |
| 2026-03-04 | MrCable0x | | |
| 2026-03-17 | Incident #1 | | |
| 2026-03-20 | March 20 2026 Theft | | |
| 2026-04-06 | Zignaly | | |
| 2026-04-09 | April 9 2026 Theft | | |
| 2026-04-23 | Apr 23 2026 Theft | | |
| 2026-04-27 | PolinRider | | |
| 2026-05-05 | May 1 2026 Theft | | |
| 2026-05-05 | May 5 2026 Theft | | |
| 2026-05-24 | Stablr | | |
| 2026-06-01 | Korporatio | | |
| 2026-06-30 | Contagious Summer | | |
| 2026-07-15 | Ostium | | |
| 2026-07-15 | Teleswap | | |
| 2026-07-24 | Triple-A | | |
| 2026-08-12 | Bitazza | | |
| 2026-08-28 | Unknown Aug 28 2026 | | |
| 2026-01-16 | Unknown Key Compromise | | |
| 2026-02-05 | Other Fake Zooms | | |
| 2026-01-08 (press release date) | New Jersey Man Pleads Guilty to Participating in Scheme to Generate Revenue for North Korean Weapons Programs | | |
| 2026-03-20 (press release date) | Three sentenced for facilitating computer access in North Korean sanctions evasion scheme | | |
| 2026-04-15 (press release date) | Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote Information Technology Worker Scheme that Generated $5M in Revenue for the Democratic People’s Republic of Korea | | |
| 2026-05-06 (press release date) | Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote Information Technology Worker Schemes to Generate Revenue for the Democratic People’s Republic of Korea | | |
| (published 26 March 2026) | UK sanctions on Xinbi marketplace, which facilitated laundering of crypto assets stolen by North Korea | | North Korea |
| 31.07.2026 (statement date) | DPRK cyber activities causing significant financial harm to the EU, Member States and partners | | DPRK |
| 31.07.2026 (statement date) | DPRK remote IT workers scheme under fake identities | | DPRK operatives |
| 2026-06-17 (page date) | North Korea cryptocurrency thefts and cybercrimes (general statement, no specific incident named) | | North Korea |
| 2026-04-02T10:00:49.000Z | Inside the Talos 2025 Year in Review: A discussion on what the data means for defenders | | |
| 2026-01-22 | KONNI Adopts AI to Generate PowerShell Backdoors | | |
| 2026-01-26 | 26th January – Threat Intelligence Report | | |
| 2026-02-23 | 2025: The Untold Stories of Check Point Research | | |
| 2026-07-01T17:53:56.469Z | PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems | | |
| 2026-08-11 | Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack | | |
| 2026-08-17 | 17th August – Threat Intelligence Report | | |
| 2026-09-07 | 7th September – Threat Intelligence Report | | |
| January 20 2026 | Threat Actors Expand Abuse of Microsoft Visual Studio Code | | threat actor operating on behalf of North Korea (DPRK) |
| Feb 16, 2026 | Bybit exploit anniversary analysis; Tenexium incident (operatives creating crypto projects) | | DPRK |
| published 2026-07-01 | North Korea-linked share of H1 2026 hack losses | | North Korea linked activity |
| 2026-06-26 (post date) | AscendEX (Bitmax) hack of December 2021 (reported) | | Lazarus Group (reportedly) |
| 2026-06-27 (post date) | Kelp DAO exploit April 18, 2026 and Humanity Protocol exploit June 9, 2026 funds commingled | | Lazarus Group (alleged for Kelp DAO) |
| 2026-10-05 (article; ZachXBT disclosure October 5) | ZachXBT infiltration of a Chinese laundering syndicate used for Bybit proceeds | Hong Kong / mainland China (per operator's claim) | Lazarus Group; Chinese laundering syndicate |
| published 2026-05-12 | DPRK-linked crypto theft 2016 to early 2026 (aggregate); 2025 annual; KelpDAO | | DPRK-linked actors |
| (page date not captured; 2026) | Lazarus Group stolen crypto totals; April 2026 KelpDAO and Drift | | Lazarus Group |
| (as of September 18, 2026) | First laptop farm dismantled in Japan | Japan | North Korean IT workers; WaterPlum |
| July 31, 2026 | North Korean IT workers: insider threat, data exfiltration, cryptocurrency theft | | North Korean IT workers |
| January 21, 2026 | PurpleBravo weaponized coding tests and likely victims across the IT software supply chain (August 2024 to September 2025) | Belgium, Bulgaria, Costa Rica, India, Italy, the Netherlands, Pakistan, Romania, the United Arab Emirates (UAE), and Vietnam | PurpleBravo |
| 2026-02-09 (datePublished) | UNC1069 intrusion at a FinTech entity using compromised Telegram account, fake Zoom meeting and deepfake | | UNC1069 |
| 2026-02-11T16:00:00.000Z | graphalgo fake recruiter campaign targets crypto developers with RAT | | Lazarus Group |
| 12/02/2026 | Multiple organizations | Global | Threat actors from China (APT31, Temp.HEX), Iran (APT42), North Korea (UNC2970), and Russia |
| 2026-02-26 | APT37 Ruby Jumper: Air-Gap Attack via Removable Media | | |
| 2026-02-27T14:18:40.511Z | StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer | | |
| Cloud Threat Horizons Report H1 2026 (no exact date on page) | UNC4899 Kubernetes compromise and cryptocurrency theft from a cryptocurrency organization (2025) | | UNC4899 |
| 2026-03-15 | Konni 그룹의 스피어피싱·카카오톡 연계 위협 캠페인 분석 | | KONNI; Konni; 코니 |
| 17/03/2026 | Developers and professionals involved in blockchain-related projects. | Global | WaterPlum (part of the Contagious Interview Campaign from North Korea) |
| 25/03/2026 | Undisclosed organizations in the retail industry | Unknown | North Korean APT groups (overlapping with "Contagious Interview") |
| 2026-04-02T13:00:00.000Z | DPRK-Related Campaigns with LNK and GitHub C2 | FortiGuard Labs | | |
| 03/04/2026 | Node.js ecosystem maintainers (Socket CEO, Platformatic CTO, Dotenv creator, Node.js Security WG, and others) | Global | UNC1069 (North Korean state-linked) |
| 2026-04-07T21:36:45.870Z | North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads | | |
| 2026-04-12 | APT37의 프리텍스팅 기반 표적 침투: 페이스북 정찰과 소프트웨어 변조 공격 분석 | | APT37 |
| 16/04/2026 | Professionals and organizations in the cryptocurrency, venture capital, and blockchain sectors | Global | Sapphire Sleet (a.k.a. BlueNoroff, APT38, Stardust Chollima) |
| 21/04/2026 | High-level fintech and cryptocurrency executives and developers using macOS | Global | Lazarus Group (aliases: Hidden Cobra, APT38, Zinc, Labyrinth Chollima) |
| 2026-04-21 | Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories | | |
| 22/04/2026 | Web developers
26,584 cryptocurrency wallets on 2,726 infected systems | Global | Famous Chollima (a.k.a. HexagonalRodent) |
| 2026-04-27T11:59:23+00:00 | BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector | North America | BlueNoroff (subgroup of Lazarus Group) |
| 29/04/2026 | Software developers (npm ecosystem)
Organizations hiring remote developers | Global | Famous Chollima (linked to Contagious Interview) |
| 2026-05-05 | Korean-speaking users via sqgame[.]net (China-based game platform) | KR,CN | APT37 (a.k.a. ScarCruft, Ricochet Chollima) |
| 2026-05-27 | South Korean military and corporate entities | KR | Kimsuky (aka Velvet Chollima, North Korea) |
| June 08, 2026 | UNK_DeadDrop developer-recruitment phishing against close to 100 organizations (April-May 2026) | | UNK_DeadDrop (very likely North Korea-aligned) |
| 2026-06-11 | Financial services firms and cryptocurrency exchanges (APAC/Oceania, 78+ organizations) | Multiple | North Korea-linked / China-linked threat groups (multiple) |
| 2026-06-14 | MS 사칭 피싱과 Dead-drop C2 기반 APT37 NarwhalRAT 분석 | | APT37 |
| 2026-06-23T21:59:42.000Z | macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox | SentinelOne | | |
| 2026-06-24 | Software developers using npm (html-to-gutenberg, fetch-page-assets) and 16 hijacked Go packages | Multiple | Unknown (linked to North Korea "Fake Font" / Contagious Interview) |
| 2026-06-30 | JavaScript build ecosystem / Developers" | Global | Lazarus Group |
| 2026-07-20 | South Korean groupware software vendors and their SaaS customers | KR | Kimsuky (APT43) |
| 2026-07-21 | Cryptocurrency and Web3 professionals | Multiple | Famous Chollima |
| 2026-07-30 | 72 South Korean organizations across financial, healthcare, and other sectors (via 15 compromised watering-hole websites) | KR | Unattributed state-sponsored group (possible Lazarus links, unconfirmed) |
| 2026-08-10T16:02:45.000Z | Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (NullReceiver / Contagious Interview) | | DPRK-linked Contagious Interview campaign; Lazarus APT group |
| 2026-08-10 | Government and critical-infrastructure organizations worldwide | US, KR | Gunra (Golden Community) |
| 01/09/2026 | Western companies in healthcare, IT, sales, and marketing | AU, MULTIPLE | FAMOUS CHOLLIMA |
| 04/09/2026 | Two South Korean organizations (automotive and media sectors) | KR | APT37 (North Korea; medium confidence) |
| 20/09/2026 | npm package @dforge-core/dforge-mcp (versions 0.2.20/0.2.21); 65+ public GitHub repositories, 73 infected files, 22 accounts | UNKNOWN | Unknown (possible unconfirmed link to PolinRider/North Korea) |
| 2026-09-18T17:00:16.000Z | Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne | | |
| 2026-09-09 | 기능별 C2 서버를 운용하는 Kimsuky 그룹의 새로운 LNK 악성코드 등장 | | Kimsuky; 김수키 |
| 2026-06-16 | Chai.js 플러그인으로 위장한 북한발 npm 악성 패키지 'chai-as-init' 분석 | | Contagious Interview |
| 2026-06-09 | 개인정보 유출 의심 문의로 위장한 Kimsuky 스피어피싱 사례 분석 | | Kimsuky; 김수키 |
| 2026-04-03 | GitLab 플랫폼을 이용한 Kimsuky 공격 사례 | | Kimsuky; 김수키 |
| 2026-01-08 | 2025년 4분기 윈도우 웹 서버 대상 악성코드 통계 보고서 | | Andariel |
| 2026-01-19 | 2025년 12월 APT 그룹 동향 보고서 | | Lazarus |
| 2026-02-13 | 2026년 1월 APT 그룹 동향 보고서 | | APT43; Andariel; KONNI; Kimsuky; Konni; Lazarus |
| 2026-03-12 | 2026년 2월 APT 그룹 동향 보고서 | | APT37; BlueNoroff; Lazarus; TA-RedAnt; 라자루스 |
| 2026-04-01 | 파이썬 기반 백도어를 유포하는 악성 LNK 및 유포 방식의 변화 (Kimsuky 그룹) | | Kimsuky |
| 2026-04-17 | 2026년 3월 국내외 금융권 관련 보안 이슈 | | Lazarus |
| 2026-05-21 | 2026년 4월 국내외 금융권 관련 보안 이슈 | | APT38; Andariel; BlueNoroff |
| 2026-05-18 | 2026년 4월 APT 그룹 동향 보고서 | | Lazarus |
| 2026-05-27 | ‘보안 메일’도 안심 금물! 카드사 사칭 악성 파일 유포 중 | | Kimsuky; 김수키 |
| 2026-06-16 | 2026년 5월 APT 그룹 동향 보고서 | | Kimsuky; Lazarus; TA-RedAnt |
| 2026-06-17 | 개인정보 동의서인 줄 알았던 바로가기 파일의 정체는? | | Kimsuky; 김수키 |
| 2026-07-14 | 2026년 6월 APT 그룹 동향 보고서 | | APT37; APT38; Kimsuky; Lazarus; TA-RedAnt |
| 2026-07-23 | Kimsuky 그룹의 외교 관련 종사자 사칭 공격 사례 (PebbleDash, PrxClient) | | Kimsuky |
| 2026-08-06 | Xctdoor와 과거 CRAT 공격 사례의 연관성 분석 (Larva-26005) | | Andariel; Larva-26005; Lazarus |
| 2026-08-20 | 2026년 7월 APT 그룹 동향 보고서 | | APT38; BlueNoroff; Kimsuky |
| 2026-09-02 | 또 김수키? 이번엔 수산 식자재 구매 요청서로 위장 | | Kimsuky; 김수키 |
| 2026-09-18 | 2026년 8월 APT 그룹 동향 보고서 | | Kimsuky; Lazarus |
| 2026-09-06 | AI Agent 'opencode'로 미끼를 만든 김수키, GitHub PAT 기반 LNK 공격 진화 | | Kimsuky; 김수키 |
| 2026-08-09 | AI를 공격 체계에 접목하는 김수키, 미끼 문서 제작부터 로컬 LLM 구축까지 | | Kimsuky; 김수키; 북한 연계 |
| 2026-05-10 | AI 딥페이크 사칭 캠페인 후속 Python 백도어 위협 분석 | | APT37 |
| 2026-07-12 | Operation Capsule Vault: EMBED_PAYLOAD_v2 기반 RokRAT 공격 체인 분석 | | APT37 |
| 2026-01-18 | 포세이돈 작전: 구글 광고 리다이렉션 메커니즘을 악용한 스피어 피싱 공격 | | APT37; KONNI; Kimsuky; Konni; 코니 |
| 2026-05-11 | 2025년 가상자산 탈취 및 방산·IT 기술 탈취 [기사: 한국 국정원 "북한, 지난해 가상자산 2조원 이상 탈취…역대 최대"] | | 북한 해킹 조직; 안다리엘 |
| 2026-01-08 | 2025년 가상자산 탈취 [기사: 국정원 "북 해킹조직 가상자산 2조2000억 빼돌려"] | | 북한 해킹조직 |
| 2026-09-16 | Ransomware Landscape in H1 2026: Statistics and Key Issues | | Andariel; Lazarus; puNK-012 |
| 2026-05-14T11:00:58 | Kimsuky targets organizations with PebbleDash-based tools | | |
| 2026-07-23 | North Korea busts elite hacking ring inside its own banks | | |
| 2026-05-03 | 북한 해커, 2026년 탈취 가상화폐 76% 차지…AI로 정교해진 해킹 | | |
| 2026-05-22T14:55:58+00:00 | RemotePE: The Lazarus RAT that lives in memory | | North Korean Lazarus subgroup (AppleJeus, Citrine Sleet, UNC4736, Gleaming Pisces) |
| 2026-09-13 | [KCSCON 2026] 엔키화이트햇 김영운 연구원 “2026년 북한 김수키 해킹그룹, 스피어피싱 넘어 지속성 확보에 집중” | | Kimsuky; 김수키 |
| 2026-08-27 | [단독] 北 IT인력, 韓 전자·IT기업 해외법인 위장취업 노렸다 | | |
| 2026-02-09 | Хакеры на госслужбе | | Lazarus |
| 2026-08-14 | 【脅威アクター解説】Kimsukyとは？ 北朝鮮のサイバースパイ集団の実態 - 押さえておきたい脅威アクター - 敵を知って攻撃をブロック(5) | | Kimsuky |
| 2026-04-13 | [Tech & Now] 그룹아이비, 북한 IT 인력 위장 취업 적발…AI·가짜 신분 활용 등 | | |
| 2026-04-13 | "개발자 구했더니 해커였다"···알고보니 북한 IT 인력의 위장 취업 | | |
| 2026-07-16 | NPCIL cyber attack explained: What was leaked in the Kudankulam data breach? | | Lazarus |
| 2026-03-06T17:00:00+00:00 (published_time) | Jasper Sleet and Coral Sleet (formerly Storm-1877) operationalizing AI in remote IT worker activity | | Jasper Sleet; Coral Sleet (formerly Storm-1877) |
| 2026-04-16T15:00:00+00:00 (published_time) | Sapphire Sleet macOS intrusion campaign (fake software update / Teams-themed lure) | | Sapphire Sleet |
| 2026-04-21T16:03:09+00:00 (published_time) | Jasper Sleet abuse of Workday Recruiting Web Service / career sites | | Jasper Sleet |
| 2026-02-10 (datePublished) | Suspected APT45 SMALLTIGER operation against South Korean defense, semiconductor, and automotive manufacturing | South Korean | APT45 (suspected) |
| 2026-02-10 (datePublished) | Suspected APT43 infrastructure mimicking German and U.S. defense-related entities (THINWAVE) | German and U.S. | APT43 (suspected) |
| 2026-02-10 (datePublished) | UNC2970 defense targeting and Gemini-assisted target profiling | | UNC2970 |
| 2026-02-10 (datePublished) | DPRK IT worker hired via facilitator for US government defense program contract (Vong case) | Maryland; Virginia | suspected DPRK IT worker |
| 2026-09-08 (datePublished) | DPRK AI misuse: IT worker bulk LLM API registration; MIDNIGHT NEPTUNE (formerly UNC1069) AI-enabled cryptocurrency theft | | MIDNIGHT NEPTUNE (formerly UNC1069); DPRK IT worker cluster |
| January 29, 2026 | GOLDEN CHOLLIMA recruitment-fraud intrusion at a European fintech company and cryptocurrency diversion (late 2024) | European; U.S., Canada, South Korea, India, and Western Europe (general targeting) | GOLDEN CHOLLIMA |
| January 29, 2026 | GOLDEN CHOLLIMA SnakeBaker / NodalBaker deployments at fintech firms (June 2025) | | GOLDEN CHOLLIMA |
| January 29, 2026 | PRESSURE CHOLLIMA high-profile cryptocurrency heists (two largest on record) | | PRESSURE CHOLLIMA (TraderTraitor) |
| January 29, 2026 | LABYRINTH CHOLLIMA targeting of European aerospace and defense manufacturers (2024-2025), logistics and shipping, U.S. manufacturing incl. hydroelectric power | European; U.S., Japanese, and Italian; U.S.-based | LABYRINTH CHOLLIMA |
| May 14, 2026 | PRESSURE CHOLLIMA theft via trojanized software in supply chain compromise; DPRK digital asset theft in 2025 (2026 Financial Services Threat Landscape Report) | | PRESSURE CHOLLIMA; DPRK-nexus groups |
| May 14, 2026 | FAMOUS CHOLLIMA and STARDUST CHOLLIMA targeting of fintechs, exchanges and banks (2026 Financial Services Threat Landscape Report) | North America, Europe, and Asia | FAMOUS CHOLLIMA; STARDUST CHOLLIMA |
| June 09, 2026 | DPRK adversaries targeting the technology sector; FAMOUS CHOLLIMA IT worker infiltration (2026 Technology Threat Landscape Report) | North America, Europe, and Asia | FAMOUS CHOLLIMA, LABYRINTH CHOLLIMA, and STARDUST CHOLLIMA |
| August 03, 2026 | STARDUST CHOLLIMA malicious npm dependency injected into at least 131 Mastra AI framework packages (June 2026) | | STARDUST CHOLLIMA |
| August 03, 2026 | FAMOUS CHOLLIMA AI supply chain compromise of cryptocurrency and blockchain companies (2026 Threat Hunting Report) | | FAMOUS CHOLLIMA |
| publication date not shown on page (2026) | Bybit theft attributed by FBI to TraderTraitor (cited in Recorded Future blog) | | TraderTraitor |
| Sat, 18 Jul 2026 00:00:00 GMT | New North Korean campaign uses fake coding interviews to steal developer credentials | | |
| Fri, 03 Apr 2026 23:17:02 GMT | Supply Chain Attacks Surge in March 2026 | | |
| 2026-05-22 | Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware | | |
| 2026/05/28 | ESET APT Activity Report Q4 2025–Q1 2026 (DPRK-related paragraph 1) | | |
| 2026/05/28 | ESET APT Activity Report Q4 2025–Q1 2026 (DPRK-related paragraph 2) | | |
| 2026-04-08T07:30:00+00:00 | Cyber Saga: In the Footsteps of the DPRK IT Workers | | |
| 2026-05-31T18:41:00.591Z | Famous Chollima Targets PHP Developers Through Compromised Packagist Package | | |
| 2026-09-17T15:33:22.860Z | PolinRider Spreads Through Compromised GitHub Accounts and Packagist | | |
| 2026-05-20T15:25:11.368Z | DPRK-aligned social engineering campaign against Node.js maintainers (mentioned in Series C announcement) | | DPRK-aligned attackers |
| 2026-08-21T17:54:18.276Z | Malicious code in development version of Laravel package linked to Famous Chollima (mentioned in PHP and Composer Support post) | | Famous Chollima |
| 2026-03-24T15:00:00.000Z | Graphalgo campaign (mentioned in "Malicious npm packages use fake install logs to load RAT") | | North Korea-backed hackers |
| 2026-04-09T15:00:00.000Z | Drift compromise and axios compromise (mentioned in "Graphalgo fake recruiter malware campaign respawned") | | North Korean state-sponsored threat actors |
| 2026-04-21T15:00:00.000Z | Kimsuky QR-code spearphishing (FBI flash alert, mentioned in "QR Code Phishing Evolves") | | Kimsuky |
| 2026-06-18T16:00:00.000Z | Claude Opus inserted malicious package into crypto trading app (mentioned in Gartner post) | | North Korea-linked hackers |
| 2026-04-09T15:00:00.000Z | Graphalgo fake recruiter malware campaign respawned | | North Korean state-sponsored threat actors |
| Aug 24, 2026 | Axios npm compromise by Sapphire Sleet (in "Shai-Hulud was the best thing to happen to supply chain security") | | Sapphire Sleet (North Korea) |
| 2026-07-15T20:23:28+00:00 | PolinRider campaign (in Cyber Risk Intelligence Brief July 2026) | | North Korea-linked PolinRider |
| 2026-08-26T19:22:32+00:00 | DPRK-linked Rust crate typosquats (proc-macro1) (in CISO Risk Intel Brief Aug 26 2026) | | DPRK |
| 2026-06-17T00:00+03:00 | Axios npm compromise attributed by Microsoft to Sapphire Sleet (mentioned in "Mastra npm Scope Takeover"; Mastra attribution not confirmed) | | Sapphire Sleet (BlueNoroff) |
| January 12, 2026 | Unmasking the DPRK Remote Worker Problem | | DPRK remote worker program; North Korean IT workers |
| September 14, 2026 | Silent Push Exposes North Korean IT Worker Recruiting Facilitators Through Discord Servers | U.S.; E.U.; LATAM (Brazil, Mexico, Argentina, Colombia, Chile) (per WebFetch summary) | North Korean IT worker ("Tec Guru" persona) |
| 2026-03-16 | Potential DPRK remote worker investigation for a corporate client (in "Corporate Threat Intelligence and Digital Investigations Explained") | China; North Korea (laptop locations) | DPRK remote worker |
| 2026-04-22 | Unmasking DPRK Cyber Threat Actors: Fake IT Worker Infrastructure (luckyguys[.]site) | | DPRK-linked fake IT workers |
| 2026-04-29 | North Korea IT workers and Lazarus fake job campaigns against the defense industrial base (in "Nation-State Threats Targeting the Defense Industrial Base") | US; UK (infrastructure nodes) | Lazarus; North Korea |
| 2026-05-21T20:51:42.000Z | Hijacked npm Package Nearly Delivers PolinRider RAT | | PolinRider (APT group linked with North Korea) |
| 2026-06-03T21:16:54.000Z | Lazarus Group's Latest: Brandjacking Campaign on npm | | Lazarus Group |
| 2026-03-17T14:00:00.000Z | ITDR incident linked to North Korean cybercrime syndicates (in "Huntress Expands Into Proactive Security Posture Management") | | North Korean cybercrime syndicates (overlapping activity) |
| 2026-05-20T13:00:00.000Z | Moonstone Sleet as a Qilin ransomware affiliate (in "Inside the RaaS Ecosystem") | | Moonstone Sleet |
| 2026-05-21T07:00:00.000Z | Workstation in The Gentlemen ransomware intrusion identified as Lazarus infrastructure (in "The Gentleman Ransomware | Defense Evasion TTPs Uncovered") | | Lazarus (per Red Asgard) |
| Q2 2026 (from title: APT QUARTERLY REPORT : APR TO JUN 2026) | Lazarus Group Q2 2026 campaigns against cryptocurrency exchanges, software vendors, defense contractors | | Lazarus Group |
| Q2 2026 (from title: APT QUARTERLY REPORT : APR TO JUN 2026) | Kimsuky Q2 2026 espionage operations | | Kimsuky |
| 2026-04-24T03:00:00+00:00 | Sapphire Sleet Fake Interview campaign with fake Zoom invites targeting Mac users | | Sapphire Sleet |
| 2026-07-17T03:00:00+00:00 | North Korea-linked hackers modified hundreds of open-source repositories targeting developers | | North Korean hackers (Contagious Interview / Famous Chollima) |
| 2026-05-01T17:59:24.669Z | DPRK Contagious Interview: Developer Workflow Compromise | | Lazarus (DPRK Contagious Interview campaign) |