3 weeks ago
North Korean hackers build AI tools for cyberattacks: report
Some computer experts in North Korea are trying to hack into computers in other countries.
A hacking group called Kimsuky does this kind of work.
A company in South Korea called Genians studies hackers and writes reports about them.
Genians found that Kimsuky now uses smart computer programs called AI.
AI is like a very clever robot brain inside a computer.
The hackers use AI tools to write tricky fake messages, called phishing, to fool people.
They also use the tools to go through information they have stolen.
The hackers pretend to be people looking for jobs at computer companies.
This helps them get close to the people they want to trick.
Genians says this makes their attacks faster and harder to stop, though the report has not been confirmed by other experts.
North Korean-linked hacking group Kimsuky built large language model tools and collected software to automate cyberattacks, analyze stolen material and craft more convincing phishing campaigns.
South Korean cybersecurity firm Genians reported the findings on Monday.
Genians found tools for running and managing AI models locally, including Ollama, GPT4All and Msty, plus retrieval augmented generation (RAG) document search technology.
Genians also found AI agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool, on infrastructure linked to the campaign.
Genians said it found finance and cryptocurrency-themed decoy documents that appeared AI-generated, and noted its findings could not be independently verified.
- Who
- Kimsuky, a North Korean-linked hacking group, and Genians, the South Korean cybersecurity firm that reported the findings.
- What
- Kimsuky built large language model tools and collected AI software to automate cyberattacks, analyze stolen material and produce more convincing phishing campaigns.
- Where
- South Korea, where Genians is based; Kimsuky targets IT firms around the world by posing as job candidates.
- When
- Reported on Monday by Genians.
- Why
- To automate cyberattacks, analyze stolen material and create more convincing phishing campaigns while keeping sensitive data off outside AI services.
Key facts
- Hacking group
- Kimsuky (North Korean-linked)
- Reporting firm
- Genians (South Korean cybersecurity firm)
- AI model tools found
- Ollama, GPT4All, Msty
- Document search technology
- Retrieval augmented generation (RAG)
- Other tools found
- AI agent frameworks, speech-to-text software, Cursor
- Decoy documents
- Finance and cryptocurrency-themed, appeared AI-generated
- Targets
- IT firms worldwide; hackers pose as job candidates
- Verification status
- Findings could not be independently verified




