North Korean Hacking Group Builds AI Tools for Cyberattacks, Report Says

North Korea's Kimsuky hacking group is reportedly advancing its cyber warfare capabilities by developing and integrating artificial intelligence tools, according to findings by South Korean cybersecurity firm Genians.

The group has allegedly set up infrastructure to run AI models locally, including Ollama, GPT4All, and Msty, alongside retrieval augmented generation (RAG) technology. This allows Kimsuky to process documents and sensitive information without relying on external AI services, thereby reducing the risk of detection.

Genians' report indicates that Kimsuky is moving beyond using generative AI solely for creating phishing emails. The group is now building capacity to embed AI models into malware development, automate attacks, and analyze stolen data more effectively. This strategic shift suggests a more sophisticated and integrated approach to cyber operations.

The firm also discovered AI agent development frameworks, speech-to-text software, and an AI-assisted coding tool, Cursor, linked to Kimsuky's activities. Furthermore, finance and cryptocurrency-themed decoy documents, potentially generated by AI, were found, designed to mimic legitimate investment reports and workplace materials.

While Genians' findings could not be independently verified, they align with previous assessments by U.S. and South Korean authorities that have identified North Korean state-linked cyber units engaging in espionage and financial theft. In 2023, the U.S. Treasury sanctioned Kimsuky, designating it as a cyber-espionage group controlled by the North Korean government and tasked with gathering intelligence to support Pyongyang's strategic objectives.

“

The findings suggest Kimsuky is moving beyond using generative AI to create phishing lures and is building capacity to integrate existing AI models into malware development, data analysis and attack automation.