North Korean hackers develop AI tools for cyberattacks

A North Korean-linked hacking group has reportedly expanded its use of artificial intelligence to strengthen

SEOUL: A North Korean-linked hacking group has reportedly expanded its use of artificial intelligence to strengthen cyberattacks, automate operations and analyse stolen data.

The group, identified as Kimsuky, has developed and collected a range of AI-related tools that could help its operators conduct attacks more efficiently, according to a South Korean cybersecurity company.

The company said it discovered infrastructure linked to Kimsuky containing several programs designed to run and manage artificial intelligence models locally. These included Ollama, GPT4All and Msty.

The hackers also appeared to be using retrieval-augmented generation technology. The system can help AI models search and process large collections of documents.

Researchers said the use of locally operated AI models could allow the group to analyse sensitive information without sending data to external AI services. This could give hackers greater control over stolen material and reduce their reliance on third-party platforms.

The investigation also uncovered AI agent development frameworks, speech-to-text software and an AI-assisted coding tool called Cursor.

According to the cybersecurity firm, the findings indicate that Kimsuky may be moving beyond the simple use of generative AI for creating phishing messages.

The group could now be seeking to integrate existing AI models into different stages of its cyber operations. These may include malware development, stolen-data analysis and attack automation.

Researchers also identified documents related to finance and cryptocurrency on the infrastructure. Some of the files appeared to have been generated using artificial intelligence.

The documents were designed to look like legitimate investment reports and other professional workplace material. Such files could potentially be used as decoys or to make malicious campaigns appear more credible.

The findings have not been independently verified. However, cybersecurity researchers and government agencies have repeatedly linked North Korean state-backed groups to international cyber operations.

North Korean cyber units have been accused of conducting espionage campaigns, stealing money and targeting cryptocurrency-related assets. Authorities in the United States and South Korea have previously warned about the activities of such groups.

Kimsuky has long been associated with cyber-espionage operations targeting governments, organisations and individuals. The group has also been accused of gathering intelligence to support North Korea’s strategic interests.

The latest findings point to a growing role for artificial intelligence in cyber operations. Security researchers have warned that AI tools can make phishing campaigns more convincing and help attackers process information and develop malicious software more quickly.