Avertium describes sustained 2022 North Korean threat activity involving Lazarus/APT38, H0ly Gh0st, PLUTONIUM and Kimsuky across cryptocurrency, ransomware and espionage operations. Lazarus activity cited from CISA used social engineering and trojanized cryptocurrency applications on Windows and macOS to steal private keys and enable fraudulent blockchain transactions. The H0ly Gh0st ransomware section links the financially motivated group to North Korean activity through Microsoft reporting on communication with Lazarus/PLUTONIUM, shared infrastructure, similar controller naming and tools, while describing SiennaBlue and SiennaPurple ransomware variants, double extortion and possible exploitation of public-facing web applications such as CVE-2022-26352. The Kimsuky sections describe SHARPEXT browser-extension theft from logged-in email sessions and phishing chains that verify victims before delivering malicious documents, HTA payloads, scheduled tasks and profiling logic against Korean peninsula-related targets.