Kimsuky Turns to AI in Bid to Enhance Cyberattack Capabilities

North Korea-linked threat actor Kimsuky is exploring ways to integrate artificial intelligence (AI) into its cyberattack operations, including malware development and data analysis. According to a recent report by Genians, Kimsuky has been setting up local AI environments using tools like Ollama, GPT4All, and Msty. This approach prevents conversation data from being transmitted to external AI services, reducing the risk of exposure.

The group's activity shows it is building capabilities to integrate AI into its attacks. Investigators detected a database linked to GPT4All's LocalDocs feature, suggesting Kimsuky may have attempted to connect documents in its possession to an AI system as a knowledge source.

Kimsuky has also collected libraries and frameworks that can integrate AI into software, including LLaMaSharp, Microsoft Semantic Kernel, and Microsoft Agents AI. These components cover local AI execution, document retrieval, automated agents, and integration with external AI services.

The use of Whisper and faster-whisper speech-to-text tools could allow Kimsuky to process and analyze stolen or collected material from compromised systems.