North Korean hacking group builds AI tools for cyberattacks, report says
Genians said the group used local AI models to process documents securely and build tools that could support malware and attack automation.
- On Aug 10, South Korean cybersecurity firm Genians reported that the North Korean-linked hacking group Kimsuky has integrated AI-enhanced tools to automate cyberattacks, analyze stolen data, and produce more convincing phishing campaigns.
- Genians discovered Kimsuky is utilizing local AI-enhanced models like Ollama, GPT4All, and Msty, alongside document search technology known as RAG, allowing operators to process documents securely without exposing sensitive data to outside services.
- The group is also employing AI-assisted coding tools like Cursor and AI-generated finance-themed decoy documents designed to resemble legitimate investment reports, marking a strategic shift toward integrating AI into malware development.
- North Korea has long used state-linked cyber units for espionage and financial theft; Treasury sanctioned Kimsuky as a government-controlled cyber-espionage group supporting Pyongyang's strategic objectives.
- While Genians noted the findings suggest advanced capabilities in malware development and attack automation, the firm acknowledged these specific reports regarding Kimsuky's AI integration could not be independently verified.
60 Articles
60 Articles
Breaking Defense
ussanews.comWhy patching networks against cyberattacks is ‘very scary’ in the age of AI
The long-standing mantra that certain operational systems must be continuously available and can’t be brought down for a patch is becoming harder to defend as cyber threats accelerate, US officials warn.
The Register
North Korean spies are running local LLMs to cause AI mischief
North Korean government snoops are operating LLMs locally and collecting technology to weave AI into their attack operations, according to South Korean security firm Genians. The researchers said they observed Kimsuky setting up and operating local LLM environments using Ollama, GPT4All, and Msty, experimenting with other AI tools such as Cursor, and using retrieval-augmented generation (RAG) for local document searches. This prevents the data f…
In the increasingly sophisticated world of cyberattacks, espionage groups are adopting new technologies to enhance their capabilities. In this context, North Korea's Kimske Group has developed offline artificial intelligence (AI) technology to bolster its malicious operations. Kimske's development of offline AI to enhance phishing and malware development means that North Korean state-sponsored hackers are no longer content with simply typing com…
Experts warn North Korean hackers are increasingly using AI to build smarter and more devious cyberattacks
Kimsuky used local AI tools to evade monitoring and enhance operationsResearchers observed extensive AI-driven capability building across the group’s infrastructureDefenders urged behavior-based detection to spot evolving AI-enabled threatsNorth Korean hackers have found a way to use Generative Artificial Intelligence (GenAI) to supercharge their activities without tipping off the tool’s maintainers.When people use AI tools like ChatGPT or Claud…
North Korean hackers use local AI to automate attacks on crypto firms
North Korea-linked hacking group Kimsuky has built three local AI environments as part of preparations for cyberattacks targeting cryptocurrency and financial companies, according to new cybersecurity research. Genians, a South Korean cybersecurity firm, said in a report released Monday that…
Coverage Details
Bias Distribution
- 45% of the sources lean Right
Factuality
To view factuality data please Upgrade to Premium
