North Korean hacking group builds AI tools for cyber attacks, report says
Sign up now: Get insights on Asia's fast-moving developments
The findings suggest North Korean-linked group Kimsuky is moving beyond using generative AI to create phishing lures.
PHOTO: ST FILE
- A North Korean hacking group, Kimsuky, has developed AI tools to automate cyberattacks, analyse stolen data, and create more convincing phishing campaigns, according to South Korean firm Genians.
- Kimsuky uses local AI models like Ollama, GPT4All, and Msty to process documents securely without sending data to outside services, enhancing malware and attack automation.
- The group employs AI-generated finance and cryptocurrency-themed decoy documents to mimic legitimate reports, supporting North Korea's espionage and financial theft activities, as noted by US and South Korean authorities.
AI generated
SEOUL – A North Korean hacking group built large language model tools and collected software that could help automate cyberattacks, analyse stolen material and produce more convincing phishing campaigns, a South Korean cybersecurity firm said on Aug 10.
The cybersecurity firm, Genians, said it found evidence that the North Korean-linked group Kimsuky had set up tools for running and managing AI models locally, including Ollama, GPT4All and Msty, alongside document search technology known as retrieval augmented generation (RAG).
According to the company, the tools could allow operators to process documents without sending sensitive information to outside AI services.
Genians also found AI agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool, on infrastructure it linked to the campaign.
The findings suggest Kimsuky is moving beyond using generative AI to create phishing lures and is building capacity to integrate existing AI models into malware development, data analysis and attack automation, Genians said in a report.
Genians also said it found finance and cryptocurrency-themed decoy documents that appeared to have been generated with AI.
The materials were designed to resemble legitimate investment reports and other workplace documents, it added.
The company’s findings could not be independently verified.
North Korea has for years used state-linked cyber units for espionage, financial theft and revenue generation, according to US and South Korean authorities, as well as cybersecurity experts.
The US Treasury in 2023 sanctioned Kimsuky as a North Korean government-controlled cyber-espionage group, saying it gathered intelligence in support of Pyongyang’s strategic objectives. REUTERS
