| Not available | North Korean State-Sponsored Hacking Group APT37 Stole Advertising Content From a South Korean Ad Agency to Target End Users in 2024 | Korea, Republic of;Korea, Republic of | APT37/Richochet Chollima/Red Eyes/InkySquid/ScarCruft/Reaper/Group123/TEMP.Reaper/Venus 121/G0067 |
| Not available | The North Korean state-aligned hacking group Moonstone Sleet delivered malicious npm packages to a victim with an associated project and stole its credentials | Not available | Moonstone Sleet / Storm-1789 |
| Not available | North Korean state-integrated hacking group Lazarus gained access to networks of defence and maritime companies | Not available;Not available;Hungary | Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| Hyperliquid Loser | | |
| Thorswap Admin Theft | | |
| October | Attacks targeting digital asset firms | | Lazarus Group |
| December | AppleJeus Attacks | | Lazarus Group |
| (not dated) | Operation Dream Job (defense industry; attacks confirmed in Japan) | Japan | Lazarus attack group (operation identified in Japan and associated with Lazarus) |
| (not dated) | Operation Dangerous Password: hijacked LinkedIn account of an employee of a Japanese crypto currency exchanger | Japan | Lazarus attack group (operation identified in Japan and associated with Lazarus) |
| (not dated) | Operation AppleJeus targeting crypto currency users via LinkedIn and Telegram | | Lazarus attack group (operation identified in Japan and associated with Lazarus) |
| 令和６年３月 26 日 (alert date) | North Korean IT workers posing as Japanese to take work on Japanese online platforms (suspected) | Japan | 北朝鮮 IT 労働者 |
| 令和７年８月２７日 (alert date) | North Korean IT workers posing as Japanese earning income via Japanese online platforms (cases confirmed) | Japan | 北朝鮮IT 労働者 |
| (not dated; 過去には) | North Korean IT workers registered accounts using ID images from third parties / relatives living in Japan | Japan | 北朝鮮 IT 労働者 |
| (not dated; 過去には) | North Korean IT worker payments routed via third-party accounts to foreign accounts | Japan | 北朝鮮 IT 労働者 |
| (not dated) | North Korean IT workers conducting illicit FX trading with self-made automated trading system | | 北朝鮮 IT 労働者 |
| H29.12.20 | Japan MOFA Press Secretary statement condemning North Korea over WannaCry (listed in NPA public-attribution table) | | 北朝鮮 |
| 令和４年１２月２日 (designation date) | Japan asset-freeze designation of Lazarus Group (with crypto addresses) | | Lazarus Group (a.k.a. Hidden Cobra; Office 91; Guardians of Peace; ...) |
| (not dated) | Andariel ransomware attacks against US healthcare organisations | United States | Andariel |
| (not dated) | Malicious cryptocurrency trading applications (AppleJeus, per footnote) targeting individuals and organizations including in Canada | Canada | North Korean cyber actors |
| (not dated) | DPRK state-sponsored ransomware and cryptocurrency theft; persistent cybercrime threat to Canada | Canada | DPRK state-sponsored cyber threat actors |
| in recent years | Fake North Korean IT workers infiltrating global companies | | fake North Korean IT workers |
| (not dated) | North Korean freelance IT workers hired abroad under false identities, stealing data or cryptocurrency | | Noord-Koreaanse freelance IT’ers |
| Depuis plusieurs années | North Korean operators targeting crypto-assets for financial gain | | MOA réputés nord-coréens |
| Harmony and Sky Mavis heists laundered via Sinbad (mentioned in OFAC context) | | Lazarus Group |
| North Korean IT workers employed by DeFi Company 1, a U.S.-based IT development company (IT Worker-1 posing as Palmer; IT Worker-2 posing as Bram Chen) | U.S. | North Korean IT workers |
| North Korean IT worker ("Alex Hong") employed by DeFi Company 2, based in the U.S., to create a DApp | U.S. | North Korean IT workers |
| Andariel Tdrop malware attacks (C2 servers registered via Yahoo accounts) | | Andariel |
| Intrusion at the "Southeast Asian Bank" | Southeast Asia | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" |
| Spear-phishing and social engineering of South Korean companies and government entities; reconnaissance of U.S. and South Korean military | South Korea | PARK JIN HYOK and co-conspirators ("subjects"); Chosun Expo; "Lazarus Group" |
| USDT in wallet addresses traceable to North Korea's laundering of the Bybit exploit proceeds (judgment creditors' motion) | | North Korea |
| Audricus Phagnasay allowed his identity to be used by overseas DPRK IT workers; received laptops and installed remote access software | U.S. (Georgia) | overseas IT workers (DPRK IT worker scheme); Audricus Phagnasay |
| (page date not captured) | North Korean DeFi thefts in 2022 (Ronin and Harmony) | | Lazarus Group |
| (not dated) | Theft of ROK military defense and response planning information | South Korea | 110th Research Center |
| (not dated) | IT workers extorting former employers | United States | Yanbian Silverstar; Volasys Silverstar |
| (not dated) | IT worker scheme assisted by Christina Chapman (Munitions Industry Department) | | Jiho Han; Haoran Xu; Chunji Jin; Zhonghua (Munitions Industry Department) |
| (not dated) | IT worker exportation/laundering scheme with U.S. laptop hosts | United States | Huang Jingbin; Yuan Ziyou and others |
| (not dated) | IT worker extortion with published source code; IT worker website defacement | | North Korean IT workers |
| (sanction listing) | Chosun Expo identified for facilitating WannaCry; sanctioned under UK cyber regime | | Chosun Expo (linked to Lazarus Group) |
| (not dated) | Lazarus social engineering (fake job portal profiles) against defense companies | | LAZARUS |
| 01/01/1970 | Targets in the US | US | Hidden Cobra (AKA Lazarus Group) |
| 01/01/1970 | North Korea | KR | China |
| 01/01/1970 | US and western financial institutions | >1 | Hidden Cobra |
| 01/01/1970 | Targets in Iran, Russia, China, and North Korea | >1 | CIA |
| 01/01/1970 | Unnamed organization in the cryptocurrency vertical | N/A | HIDDEN COBRA AKA The Lazarus Group AKA APT38 |
| January | Distribution of KONNI RAT | | Kimsuky |
| February | APT attacks using DPRK related documents | | Kimsuky |
| March | APT attacks using Word Files about Cryptocurrency | | Kimsuky |
| April | Targeting Chemical Sector (Operation Dream Job) | | Lazarus Group |
| May | Exploiting Log4Shell Vulnerability (NukeSped) | | Lazarus Group |
| “SHARPEXT” malicious browser extension campaign | | Kimsuky (“Sharptongue”) |
| August | AppleSeed on Nuclear Energy related Industries | | Kimsuky |
| MacOS spear-phishing with fake Coinbase job advertisements targeting fintech developers | | Lazarus Group |
| September | Amazon-themed campaigns (Dell) | | Lazarus Group |
| September | Three RATs attack | | Lazarus Group |
| Windows rootkit exploiting a Dell firmware driver (CVE-2021-21551), BLINDINGCAN backdoor; target included an aerospace company employee | | Lazarus Group |
| DLL side-loading attacks and vulnerable driver modules | | Lazarus Group |
| November | Targeting Ukraine Entities | | Lazarus Group |
| January | Malware Disguised as a Manuscript Solicitation Letter (Targeting Security-Related Workers | | Kimsuky |
| January | ta444-apt-startup-aimed-at-your-funds | | TA444 (Overlaps with BlueNoroff) |
| January | 疑似 APT-C-26 （ Lazarus）组织通过 加密货币钱包推广信息 进行攻击活动分析 | | Lazarus Group |
| April | bluenoroff-apt-targets-macos-rustbucket-malware/ | | BlueNoroff |
| May | Kimsuky Group's Phishing Attacks Targeting North Korea-Related Personnel | | Kimsuky |
| May | Lazarus Group Targeting Windows IIS Web Servers | | Lazarus Group |
| May | kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/ | | Kimsuky |
| May | kimsuky-evolves-reconnaissance-capabilities-in-new-global-campaign/ | | Kimsuky |
| May | https://www.police.go.kr/viewer/skin/doc.html?fn=d6c2795c-3930-44ab-970d-d2d7a14f9571.hwpx&rs=/viewer/202305 (see S/2023/656 Annex 65) | | DPRK cyber actors (suspected Kimsuky) |
| June | APT-C-26（ Lazarus） 组织使用伪造 VNC 软 件的攻击活动分析 | | Lazarus Group |
| July | https://www.qianxin.com/threat/reportdetail?report_id=295 https://www.qianxin.com/threat/reportdetail?report_id=292 | | Lazarus/ Kimsuky |
| July | https://www.mandiant.com/resources/blog/north-korea-supply-chain | | DPRK cyberthreat actor |
| July | https://asec.ahnlab.com/ko/55646/ | | Kimsuky |
| August | Cyber attack confirmed to have been carried out by North Korea’s ‘Kimsuky’ targeting ROK-US joint military exercises | | Kimsuky |
| September | Active North Korean campaign targeting security researchers | | DPRK cyber actors |
| September | threat_inteligence_report_k onniapt.pdf | | ScarCruft |
| September | http://english.chosun.com/site/data/html_dir/2023/09/07/2023090701108.html | | DPRK cyber threat actors |
| September | https://paper.seebug.org/3033/ | | ScarCruft |
| September/ October | lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/ Lazarus-campaigns-and-backdoors-in-2022-2023.pdf | | Lazarus Group |
| September/ October | https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/ https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/ | | Lazarus/ Andariel |
| October | north-korea-cyber-structure-alignment-2023 | | All DPRK malicious cyber groups |
| October | security-insider/microsoft-digital-defense-report-2023?rtc=1 | | Lazarus/ Andariel/ BlueNoroff |
| October | https://www.hauri.co.kr/security/security.html | | Lazarus |
| October | 국정원 “北 , 김정은 군함 건조 지시에 국내 조선사 해킹 시도 ” (chosun.com) | | DPRK cyberthreat actor |
| Use of generative AI / ChatGPT for phishing and malware development | | Kimsuky; Democratic People’s Republic of Korea cyberactors |
| October | APT trends report Q3 2023 | Securelist | | Lazarus Group |
| October | A Cascade of Compromise: Kaspersky Exposes Lazarus’ New Campaign Exploiting Legitimate Software | Kaspersky | | Lazarus Group |
| November | 보도자료 : HOME > 알림 /소식 > 알림 > 보도자료 (police.go.kr) | | DPRK cyber actors |
| November | Microsoft: BlueNoroff hackers plan new crypto-theft attacks | | BlueNoroff |
| November | konni-campaign-distributed-via-malicious-document | | ScarCruft |
| November | https://rt-solar.ru/events/news/3851/ | | Lazarus Group |
| November | https://asec.ahnlab.com/ko/58818/ | | DPRK cyber actors |
| November | https://asec.ahnlab.com/en/59073/ | | Andariel |
| November | https://asec.ahnlab.com/ko/59130/ https://asec.ahnlab.com/en/59318/ | | Andariel |
| November | 수입 신고서를 위장하여 국내 연구 기관을 노리는 Kimsuky | | Kimsuky |
| December | https://www.koreaherald.com/view.php?ud=20231201000614 | | Lazarus Group |
| December | 疑似 Lazarus（ APT-Q-1）涉及 npm 包供应链 的攻击样本分析 | | Lazarus Group |
| December | Kimsuky Group Uses AutoIt to Create Malware (RftRAT, Amadey) | | Kimsuky |
| December | https://asec.ahnlab.com/en/60054/ | | Kimsuky |
| December | https://mp.weixin.qq.com/s/f5YE12w3x3wad5EO0EB53Q https://blog.phylum.io/crypto-themed-npm-packages-found-delivering-stealthy-malware/ | | Lazarus Group |
| December | 북한 시장 물가 분석 문서 등으로 위장된 공격 사례 (genians.co.kr) | | Kimsuky |
| December | https://www.koreatimes.co.kr/www/nation/2023/12/103_364423.html | | Andariel |
| Cyberattacks against the Panel | | |
| Monero cryptojacking malware sending mined currency to servers at Kim Il Sung University | | |
| Attacks against Korea Hydro and Nuclear Power | Republic of Korea | Kimsuky Group (also known as Velvet Chollima) |
| Spearphishing of 38 email addresses of foreign government representatives to the UN | | DPRK cyber actor associated with the Kimsuky cyber threat group |
| Alleged attempts to hack a financial institution in Chile | Chile | |
| Cyberattacks against two German defence companies (fake job offers) | Germany | Lazarus Group |
| Cyberattacks against pharmaceutical companies developing COVID-19 vaccines | | persistent threat actors known to be associated with the DPRK (TTPs match Lazarus) |
| Spear-phishing campaigns against the cryptocurrency industry | | |
| TA406 and TA427 campaigns using false email accounts impersonating individuals and entities | Republic of Korea; United States; Russian Federation (identities used) | “TA406” and “TA427”, cyberactors associated with Kimsuky |
| Hacking attempts and phishing messages against the Panel | | cyberactors of the DPRK |
| Cyber theft of technological information for the Hwasong-8 hypersonic missile | | DPRK cyber hackers (per a Member State) |
| Kimsuky attacks on political institutions using ‘KONNI’ RAT; spoofed phishing emails to the Panel | | Kimsuky |
| Malicious Word files with DPRK-related materials sent from fake personae | | Kimsuky |
| Disguised malicious attachments (Word macro, CHM, OneNote) leaking victim data | | Kimsuky |
| Fake webmail website of a DPRK-related research institute used for credential phishing | | Kimsuky |
| Malware hidden with Alternate Data Stream | | Kimsuky |
| ReconShark-related spear-phishing targeting emails of various United Nations personnel | | Kimsuky |
| DPRK IT worker stole tokens from a cryptocurrency platform via vulnerabilities he wrote into its smart contracts | | a DPRK IT worker |
| DPRK IT worker developing smart contracts for cross-chain bridges while posing as a Western Hemisphere citizen | | a DPRK IT worker |
| Malicious Python packages (typosquatting) on an open-source Python repository | | Lazarus Group |
| Fake employers luring software developers to install malware from GitHub through job interviews | | Democratic People’s Republic of Korea actors |
| Malicious Android apps disguised as e-commerce, Google Authenticator, anti-virus and payment apps | | Kimsuky |
| Persistent spearphishing of the private email address of a member of the Panel | | Democratic People’s Republic of Korea cyberactors, probably Kimsuky |
| WinRAR vulnerability (CVE-2023-38831) attack on the cryptocurrency industry | | ScarCruft |
| Kimsuky cryptocurrency mining, cryptojacking and cybercrime operations | | Kimsuky (APT 43) |
| Andariel ransomware attacks on three companies | | Andariel |
| Phishing campaigns targeting cryptocurrency industry workers, including blockchain engineers | | The Lazarus Group and BlueNoroff |
| Ransomware distributed in collaboration with a Republic of Korea company; recovery costs from more than 700 victims | Republic of Korea | Lazarus Group actors |
| Malicious NPM packages for skill assessment tests (e.g. “myetherpackage,” “cryptooooo,” “libcrypt-test”) | | CryptoCore, in addition to other DPRK actor groups |
| IT worker projects in the United Kingdom (e.g. Nodexa token hosting platform) | United Kingdom | DPRK IT workers (per Mandiant) |
| Kyonghung IT: gambling website development, sale of personal data from client databases, SEO for criminal organizations | China (Dandong) | Kyonghung Information Technology Exchange Company (Office 39) |
| Theft of designs and technology (semiconductors, uranium processing, air defense, missiles, SLBM; satellite optical equipment) from the ROK and the UK | Republic of Korea; United Kingdom | North Korea |
| Targeting of a South African satellite company | South Africa | |
| profile page (no date shown) | VELVET CHOLLIMA intelligence collection operations (actor profile) | U.S., European, and Republic of Korea (RoK) | VELVET CHOLLIMA (Kimsuky, APT43, etc.) |
| profile page (no date shown) | RICOCHET CHOLLIMA espionage operations (actor profile) | Republic of Korea (ROK) | RICOCHET CHOLLIMA (APT37, ScarCruft) |
| publication date not shown on page | Crypto Country: North Korean cryptocurrency theft since 2017 | South Korean market; globally | North Korean threat actors |
| APT-C-55（Kimsuky）组织依托GitHub+Dropbox分发恶意载荷的攻击活动分析-安全资讯-360官网 | | |
| Jamf Threat Labs discovers a new threat targeting macOS | | |
| Contagious Interview: Trojanized macOS Installers | | |
| Alleged North Korean Campaign HIDDEN COBRA Targets Critical Industries | | |
| A Look into the Lazarus Group’s Operations | | |
| (no date on page) | How North Korea-Backed Lazarus Group is Weaponizing Open Source to Target Developers (whitepaper landing page) | | Lazarus Group |
| (no date on page) | Lazarus Hermes ransomware use (in 4 Ransomware Trends to Watch in 2019) | | Lazarus group |
| (no date on page) | North Korean ransomware: WannaCry and Maui (in Ransomware as a State-Sponsored Weapon) | UK | Lazarus Group; North Korea |
| (no date on page) | ClickFix use by PurpleBravo (in ClickFix Campaigns Targeting Windows and macOS) | | North Korean group PurpleBravo |
| (no date on page) | Lazarus React2Shell exploitation to deploy COPPERHEDGE (in H1 2026 Malware Vulnerability Trends) | | Lazarus |
| (no date on page) | APT37 Facebook-based pretexting campaign with tampered PDFelement installer (in H1 2026 Malware Vulnerability Trends) | | APT37 |
| (no date on page) | North Korea IT employment scheme / PurpleDelta (in Synthetic Identities: A Dual Threat to Enterprises) | US | PurpleDelta (North Korea) |
| (no date on page) | From North Korean Phishing to Underground Online Hosting Services (Konni campaigns) | Bulgaria (hosting IP range) | APT37 (suspected); Konni |
| (no date on page) | Spear Phishing Attack by N. Korean Hacking Group, Kimsuky | Japan; United States; Russia; European nations; South Korea | Kimsuky (aka Velvet Chollima, Black Banshee, Thallium) |
| (no date on page) | Tracking DangerousPassword Campaign by Lazarus Group | North America; Europe; East Asia | Lazarus Group |
| (no date on page) | NukeSped RAT Report | US; South Korea; Japan; Asia Pacific countries | Lazarus Group (North Korea) |
| (no date on page) | Lazarus Group Recent Trends (13 campaigns observed in 2022) | United States; Japan; Singapore; India; United Kingdom | Lazarus Group |
| (no date on page) | Analysis of Konni RAT: Stealth, Persistence, and Anti-Analysis Techniques | Russia; East Asia; Europe; Middle East | APT37 (Konni) |
| (no date on page) | DPRK Sanctions Violations in Cyber Operations Post UN Panel Demise (2024 cryptocurrency theft; Bybit; DMM Bitcoin) | | North Korean hackers; DPRK cyber actors |
| (no date on page) | Lazarus campaign targeting fintech companies | | Lazarus group |
| (no date on page) | North Korea’s Lazarus: their initial access trade-craft using social media and social engineering | | Lazarus |
| (no date on page) | RIFT: Analysing a Lazarus Shellcode Execution Method (macro documents disguised as job descriptions via LinkedIn) | | Lazarus group |
| (no date on page) | HIDDEN COBRA Volgmer: A Technical Analysis (FALLCHILL and Volgmer US-CERT alerts) | | HIDDEN COBRA (North Korean government) |
| (no date on page) | Lazarus Group portrait: Sony Pictures 2014, Central Bank of Bangladesh 2016, WannaCry 2017 | Bangladesh | Lazarus |
| (no date on page) | AppleJeus macOS trojan | | Lazarus Group |