North Korean hacking group develops AI tools to automate cyberattacks
A South Korean cybersecurity firm reported that North Korea's Kimsuky hacking group has developed tools to run AI language models locally and is building capabilities to automate cyberattacks, analyze stolen data, and improve phishing campaigns. The group has integrated these AI models into malware development and attack automation. The U.S. Treasury had previously sanctioned Kimsuky in 2023 as a state-sponsored cyber-espionage group.
What happened
A South Korean cybersecurity firm, Genians, reported finding evidence that Kimsuky, a North Korean hacking group, developed tools to run and manage large language model AI systems locally, including Llama, GPT-4 All, and Mistral, alongside retrieval-augmented generation technology.
According to Genians, these tools could enable operators to process documents without sending sensitive information to external AI services and help automate cyberattacks, analyze stolen materials, and launch more convincing phishing campaigns.
Genians found that Kimsuky is building capabilities to integrate AI models into malware development, data analysis, and attack automation, going beyond using generative AI solely for creating phishing tools.
Reported impact
The U.S. Department of the Treasury imposed sanctions on Kimsuky in 2023 as a state-sponsored North Korean cyber-espionage group.
Index analysis
U.S. and South Korean authorities have stated that North Korea has used state-linked cyber units for espionage, theft, and money-gathering purposes for years.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.