Kimsuky Group Leverages AI to Enhance Cyberattack Operations

North Korean hackers have been using artificial intelligence (AI) in their cyberattack operations, according to a report by Genians. The Kimsuky group, associated with North Korea, has installed multiple AI tools on its infrastructure, including Ollama, GPT-4All, and Msty, which enable it to examine stolen documents without transferring private information to outside AI services.

The use of AI in cyberattacks is becoming increasingly prevalent, with Genians discovering that Kimsuky intends to use AI internally and repeatedly during cyber operations instead of relying solely on public AI chatbots. Additionally, the group has been employing RAG technology, which can quickly search and extract data from large collections of stolen files.

The report also notes that Kimsuky is utilizing AI-agent frameworks to automate some of its cyber operations and reduce manual labor. Furthermore, the team is using speech-to-text software and Cursor, an AI coding tool, to accelerate the development of malware and code.

AI-enabled scam activity has increased by about 500% in the last year, with DeFiLlama reporting that the total value hacked in 2026 has reached $1.195 billion. While this is lower than the $2.3 billion taken in H1 2025, it highlights the growing sophistication of cyberattacks and the need for increased security measures.