North Korean hacking group builds AI tools for cyber attacks, report says

North Korea's Kimsuky hacking group is leveraging artificial intelligence to bolster its cyberattack capabilities, a South Korean cybersecurity firm reported. Genians found evidence that the group has developed tools for managing AI models locally, enabling them to process sensitive information without relying on external AI services. These advancements could allow for more sophisticated phishing campaigns, automated attacks, and improved data analysis.

The cybersecurity firm's analysis revealed that Kimsuky has integrated AI model management software like Ollama and GPT4All, alongside retrieval augmented generation (RAG) technology. Additionally, the group appears to be utilizing AI agent development frameworks, speech-to-text software, and AI-assisted coding tools. Genians also identified finance and cryptocurrency-themed decoy documents that were likely generated using AI, designed to mimic legitimate investment reports.

“

The findings suggest Kimsuky is moving beyond using generative AI to create phishing lures and is building capacity to integrate existing AI models into malware development, data analysis and attack automation.

These findings suggest Kimsuky is moving beyond simply using generative AI for phishing lures. The group is reportedly building capacity to integrate existing AI models directly into malware development, data analysis, and the automation of cyberattacks. North Korea has long been accused by US and South Korean authorities of employing state-linked cyber units for espionage and financial theft, with Kimsuky itself being sanctioned by the U.S. Treasury in 2023 for its role in intelligence gathering.

“

The materials were designed to resemble legitimate investment reports and other workplace documents.