Jakarta, ThedailyID — A North Korean hacking group has reportedly developed artificial intelligence tools to automate cyberattacks, analyze stolen data, and improve phishing operations, according to a new cybersecurity report.
South Korean cybersecurity firm Genians said it uncovered evidence that the hacking group Kimsuky has been building the infrastructure needed to run large language models (LLMs) locally. The reported setup includes AI tools such as Ollama, GPT4All, Msty, and Retrieval-Augmented Generation (RAG) technology.
According to Genians, these tools allow hackers to process sensitive documents without sending data to external AI services. As a result, the group can keep stolen information within its own infrastructure.
The company also discovered AI agent development frameworks, speech-to-text software, and the AI-assisted coding tool Cursor on systems linked to the operation.
Reuters reported that the findings suggest Kimsuky is moving beyond using generative AI to create phishing emails. Instead, the group appears to be integrating AI into malware development, data analysis, and attack automation.
In addition, Genians found AI-generated documents related to finance and cryptocurrency. The materials allegedly mimic legitimate investment reports and workplace documents to make phishing attempts appear more convincing.
However, the company’s findings have not been independently verified.
Authorities in the United States and South Korea have long accused North Korea of using state-backed cyber units for espionage, financial theft, and intelligence gathering.
In 2023, the U.S. Treasury Department imposed sanctions on Kimsuky, describing it as a North Korean government-controlled cyber espionage group that collects intelligence to support Pyongyang’s strategic objectives.
