Experts warn North Korean hackers are increasingly using AI to build smarter and more devious cyberattacks
In cybercrime, AI is used for more than simply drafting phishing emails and defenders need to adapt, new report states.
Recent reports indicate North Korean hackers are increasingly leveraging artificial intelligence to enhance the sophistication and stealth of their cyberattacks. Researchers observed a marked trend of Kimsuky, a state-sponsored North Korean threat actor, employing local AI tools to evade detection and streamline their operations. By utilizing tools like Ollama, GPT4All, and Msty, among others, the hackers were able to process sensitive information locally, without transmitting it to external AI services.
Genians, a security research firm, conducted extensive tracking and log analysis to identify the AI-driven capabilities utilized by the group. Their investigation revealed a comprehensive process of capability development within Kimsuky's infrastructure. This included setting up local Large Language Model (LLM) runtime environments, configuring Retrieval Augmented Generation (RAG) based on documents controlled by the threat actor, amassing AI agent development frameworks, and acquiring libraries for integration with external commercial AI services.
The researchers emphasized that the use of AI in cybercrime is progressing rapidly, moving beyond mere drafting of phishing emails and malicious web pages. Defenders are urged to shift their focus from traditional content-based detection methods to behavior-based detection strategies. This change is deemed crucial for accurately identifying and mitigating the evolving AI-enabled threats posed by North Korean hackers.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
