North Korean hackers develop AI tools for automated cyberattacks
According to a report released on Monday by South Korean cybersecurity firm Genians, a North Korean hacker outfit has created large language model tools and gathered software that might aid in automating intrusions, analysing stolen data, and producing more convincing phishing operations. The firm reported discovering evidence that Kimsuky, a hacking group associated with North Korea, had established tools for the local operation and management of AI models, including Ollama, GPT4All, and Msty, in conjunction with document search technology referred to as retrieval-augmented generation, according to reports. The tools could enable operators to process documents while maintaining the confidentiality of sensitive information, as stated by Genians.
Genians identified AI agent development frameworks, speech-to-text software, and Cursor, an AI-assisted coding tool, associated with the infrastructure tied to the campaign. The findings indicate that Kimsuky is advancing beyond the utilisation of generative AI for crafting phishing lures and is developing the capability to incorporate existing AI models into malware development, data analysis, and attack automation, as reported by Genians. The cybersecurity firm reported the discovery of decoy documents themed around finance and cryptocurrency, which seemingly were produced using artificial intelligence. The materials were crafted to mimic authentic investment reports and various workplace documents, it stated.
The findings could not be independently verified, according to the report. According to US and South Korean authorities, along with cybersecurity experts, North Korea has long employed state-linked cyber units for purposes of espionage, financial theft, and revenue generation. A Genians report published in September 2025 found that the Kimsuky espionage group had utilised OpenAI’s ChatGPT to produce a convincing counterfeit military identification card as a component of a phishing campaign aimed at South Korean targets.
The AI-generated ID was utilised to enhance the credibility of phishing emails, while the malicious attachments facilitated the deployment of backdoors and the extraction of data, according to the report. The findings indicate a significant increase in North Korea’s utilisation of AI for cyber operations, encompassing the creation of deepfakes and phishing content, as well as facilitating various types of social engineering, as reported by Genians. The US Treasury sanctioned Kimsuky in 2023, designating it as a North Korean government-controlled cyber-espionage group. The group reportedly collected intelligence to bolster Pyongyang’s strategic aims.
