A North Korea-linked hacker group called Kimsuky has developed artificial intelligence tools for use in cyberattacks, according to a report by South Korean cybersecurity firm Genians. The report said the group uses various software to run and manage AI models locally.
Genians said its review found large language model tools including Ollama, GPT4All and Msty on infrastructure linked to Kimsuky. The firm also said the attackers were using Retrieval Augmented Generation, or RAG, technology to search documents more effectively.
This setup allows sensitive documents to be processed on local systems without being sent to external AI services for analysis, according to Genians, making it possible for attackers to analyze stolen data without transmitting it elsewhere.
AI threat grows in cybersecurity
Genians said its findings show Kimsuky is not using generative AI only to craft more convincing phishing messages. The group is preparing to bring AI models into broader processes including malware development, analysis of stolen data and automation of cyberattacks, the firm said.
Genians also said it detected fake finance and cryptocurrency-themed documents believed to have been produced using AI, designed to imitate legitimate investment reports and corporate business documents. Such content may be intended to make targets trust the documents, boosting the success of phishing and social engineering attacks, according to the report.
Kimsuky has for years been linked to cyber operations tied to North Korea, which uses state-linked hacker groups for espionage, financial theft and revenue generation, the report said.
