A North Korean Hacking Group is Building AI Tools for Cyberattacks

A North Korean hacking group has built tools using large language models and collected software that could help automate cyberattacks, analyse stolen data and create more convincing phishing campaigns, a South Korean cybersecurity firm said on Monday.

Genians said it found evidence that the North Korean-linked group Kimsuky had established tools to run and manage artificial intelligence models locally, including Ollama, GPT4All and Msty.

The group also used retrieval augmented generation (RAG), a technology that allows AI systems to retrieve information from documents and other data sources when generating responses, Genians said.

The tools could allow Kimsuky operators to process documents without sending sensitive information to external AI services, according to the cybersecurity firm.

Genians also found AI agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool, on infrastructure it linked to the campaign.

The findings suggest Kimsuky is moving beyond using generative AI to create phishing lures and is developing the capacity to integrate existing AI models into malware development, data analysis and attack automation, Genians said in a report.

Genians said it also identified finance- and cryptocurrency-themed decoy documents that appeared to have been generated using AI. The materials were designed to resemble legitimate investment reports and other workplace documents, the company said.

The findings could not be independently verified.

North Korea has for years used state-linked cyber units for espionage, financial theft and revenue generation, according to U.S. and South Korean authorities and cybersecurity experts.

The U.S. Treasury in 2023 sanctioned Kimsuky as a North Korean government-controlled cyber-espionage group, saying it gathered intelligence in support of Pyongyang’s strategic objectives.

Stay ahead of the Stories shaping our world. Subscribe to Impact Newswire and join our 
WhatsApp Channel for updates on global tech, business, and innovation—all in one place.

Dive deeper into the future with the Cause Effect 4.0 Podcast, where we explore the ideas, trends, and technologies driving the global AI conversation.

Got a story to share? Contact Us to reach a global audience with Impact Newswire.