{
  "id": 462804,
  "title": "Experts warn North Korean hackers are increasingly using AI to build smarter and more devious cyberattacks",
  "url": "https://urgent.news/2026/08/10/experts-warn-north-korean-hackers-are-increasingly-using-ai-to-build",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-10T11:25:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/experts-warn-north-korean-hackers-are-increasingly-using-ai-to-build-smarter-and-more-devious-cyberattacks"
  },
  "original_language": "en",
  "account": "Recent reports indicate North Korean hackers are increasingly leveraging artificial intelligence to enhance the sophistication and stealth of their cyberattacks. Researchers observed a marked trend of Kimsuky, a state-sponsored North Korean threat actor, employing local AI tools to evade detection and streamline their operations. By utilizing tools like Ollama, GPT4All, and Msty, among others, the hackers were able to process sensitive information locally, without transmitting it to external AI services.\n\nGenians, a security research firm, conducted extensive tracking and log analysis to identify the AI-driven capabilities utilized by the group. Their investigation revealed a comprehensive process of capability development within Kimsuky's infrastructure. This included setting up local Large Language Model (LLM) runtime environments, configuring Retrieval Augmented Generation (RAG) based on documents controlled by the threat actor, amassing AI agent development frameworks, and acquiring libraries for integration with external commercial AI services.\n\nThe researchers emphasized that the use of AI in cybercrime is progressing rapidly, moving beyond mere drafting of phishing emails and malicious web pages. Defenders are urged to shift their focus from traditional content-based detection methods to behavior-based detection strategies. This change is deemed crucial for accurately identifying and mitigating the evolving AI-enabled threats posed by North Korean hackers.",
  "summary": "In cybercrime, AI is used for more than simply drafting phishing emails and defenders need to adapt, new report states.",
  "key_points": [
    "North Korean hackers use AI tools like Ollama, GPT4All, and Msty.",
    "Genians tracked AI-driven capabilities in Kimsuky's infrastructure.",
    "Experts urge defenders to adopt behavior-based detection strategies."
  ],
  "editors_take": "North Korean hackers' adoption of AI tools enables them to evade detection and enhance their cyberattacks, forcing defenders to shift from content-based to behavior-based detection strategies to counter the evolving threats.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}