North Korean Hackers Leverage Local AI for Sophisticated Crypto Attacks

North Korean hackers have been using local AI environments to automate attacks on cryptocurrency and financial companies, according to new cybersecurity research. Genians, a South Korean cybersecurity firm, discovered that Kimsuky, a North Korea-linked hacking group, had built three local AI environments using Ollama, GPT4All, and Msty.

The local AI systems allow operators to make queries without sending sensitive attack information to external cloud services, providing them with greater control and flexibility. This capability is particularly concerning as it enables Kimsuky to use AI-generated phishing documents targeting cryptocurrency firms.

Researchers found that Kimsuky had also collected the AI coding assistant Cursor and speech-to-text tools as it assembled its AI infrastructure. The firm assessed that the activity was more than isolated tests, but rather continuous preparations to incorporate AI into operational attack capabilities.