North Korea's Kimsuky Hacking Group Builds Advanced AI Cyberattack Tools

North Korea's hacking group, Kimsuky, has been building advanced AI tools to aid in cyberattacks, according to South Korean cybersecurity firm Genians.

The tools include large language model tools such as Ollama, GPT4All, and Msty, which can help automate cyberattacks, analyze stolen material, and create more convincing phishing campaigns.

Genians found that Kimsuky has set up tools for running and managing AI models locally, allowing operators to process documents without sending sensitive information outside. This suggests the group is moving beyond using generative AI to create phishing lures and is building capacity to integrate existing AI models into malware development, data analysis, and attack automation.

The firm also discovered finance and cryptocurrency-themed decoy documents that appeared to have been generated with AI. These materials were designed to resemble legitimate investment reports and other workplace documents, aiming to deceive targets.