North Korea's Hackers Build Local AI Capabilities for Easier Crypto Attacks

North Korea's hackers have been targeting the cryptocurrency industry for years, and now one of its groups, Kimsuky, is building local AI capabilities that could make those attacks easier to scale. According to South Korean cybersecurity firm Genians, researchers identified local deployments of AI tools including Ollama, GPT4All, and Msty, as well as retrieval-augmented generation (RAG) technology.

This setup allows attackers to process sensitive information without sending it to an external AI provider, which may be relevant when handling stolen emails or internal documents obtained during an intrusion. Genians also identified AI-agent frameworks, speech-to-text software, and Cursor, an AI-assisted coding tool, on infrastructure linked to Kimsuky.

The cybersecurity firm said the setup could support activities including malware development, data analysis, and attack automation. The findings suggest that Kimsuky may be moving beyond using generative AI primarily for creating individual phishing lures toward incorporating AI tools into a broader operational workflow.