N.K. hacking group Kimsuky used AI coding agents to create decoys: report

SEOUL, Sept. 7 (Yonhap) -- A North Korean hacking group known as Kimsuky has reportedly employed artificial intelligence (AI) coding agents to generate decoys for their malicious codes, according to a security firm's latest threat intelligence report. The findings emerged from an analysis of 13 malicious files collected last month, Genians Inc. revealed in its cybersecurity threat intelligence report.

The hacking group allegedly distributed emails containing compressed files with titles resembling insurance bills or policy fund notices. Upon user interaction, the files triggered malware activation, as stated in the report. Notably, the files exhibited evidence of being generated by an open-source AI coding agent called opencode.

In some instances, the PDF documents' creator and producer fields in the metadata were labeled as opencode, suggesting that the documents were likely created by an AI agent through programming rather than manual input. This marks the first instance, as far as Genians is aware, of Kimsuky leveraging AI coding agents in their malicious attacks.

Previously, the company had noted signs of the hacking group using large language models (LLMs) to create decoys and plan their malicious activities.