North Korean hacking group builds AI tools for cyberattacks, report says

A South Korean cybersecurity firm has uncovered evidence that a North Korean hacking group, Kimsuky, has developed artificial intelligence tools for cyberattacks, according to a report on Monday. The firm, Genians, discovered Kimsuky had set up large language model tools and software that could automate cyberattacks, analyze stolen data, and create more convincing phishing campaigns.

The tools included Ollama, GPT4All, Msty for running and managing AI models locally, retrieval augmented generation technology for document search, speech-to-text software, and an AI-assisted coding tool named Cursor. These tools would allow Kimsuky operators to process documents without transmitting sensitive information to external AI services.

The report also revealed finance and cryptocurrency-themed decoy documents that appeared to have been generated using AI to resemble legitimate investment reports. While these findings could not be independently verified, the cybersecurity firm's investigation suggests Kimsuky is advancing beyond using generative AI for phishing lures, integrating existing AI models into malware development, data analysis, and attack automation.

North Korea has long employed state-linked cyber units for espionage, financial theft, and revenue generation, as reported by US and South Korean authorities, as well as cybersecurity experts. In 2023, the US Treasury sanctioned Kimsuky, classifying it as a North Korean government-controlled cyber-espionage group responsible for intelligence gathering to support Pyongyang's strategic objectives.