A North Korean-linked hacking group has built tools around large language models and collected software that could help automate cyberattacks, analyse stolen information and produce more convincing phishing campaigns, according to findings from South Korean cybersecurity firm Genians.
The company said it found evidence that Kimsuky had established infrastructure for running and managing artificial intelligence models locally. The setup included Ollama, GPT4All and Msty, alongside retrieval-augmented generation technology designed for document search.
Hackers Build Capacity to Run AI Models Locally
The tools could allow operators to process documents without sending sensitive information to external artificial intelligence services.
The cybersecurity firm also found AI agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool, on infrastructure it linked to the campaign.
The findings suggest Kimsuky may be moving beyond simply using generative AI to produce phishing material. Genians said the group appeared to be developing the capacity to integrate existing AI models into malware development, data analysis and attack automation.
Such an approach could potentially allow operators to use AI across different stages of cyber operations while keeping stolen or sensitive information within locally controlled infrastructure.
Finance and cryptocurrency-themed decoy documents were also discovered that appeared to have been generated using artificial intelligence.
The materials were designed to resemble legitimate investment reports and other workplace documents, potentially making deceptive content appear more credible to intended targets.
The findings indicate that AI could be used not only to generate phishing lures but also to assist with the broader processing and exploitation of information obtained during cyber operations. The findings could not be independently verified.
Kimsuky Linked to Espionage and Financial Activity
North Korea has for years used state-linked cyber units for espionage, financial theft and revenue generation, according to U.S. and South Korean authorities as well as cybersecurity experts.
The latest findings point to the potential integration of artificial intelligence into those cyber capabilities, with locally deployed models offering tools for analysing information, developing malicious software and automating parts of an attack.
The development could represent a shift from using generative AI primarily to create content towards incorporating the technology more directly into the technical infrastructure supporting cyber operations.
