North Korean hacking group builds AI tools for cyberattac…

A North Korean hacking group known as Kimsuky has developed AI tools capable of enhancing cyberattacks, according to South Korean cybersecurity firm Genians. These tools include large language models and software for automating data analysis and phishing campaigns. Key features identified include frameworks for AI agent development, speech-to-text software, and AI-assisted coding tools. The group is reportedly using these capabilities not only for phishing but also to integrate AI into malware development. Genians discovered AI-generated decoy documents that mimic real investment reports, illustrating a sophisticated evolution in their cyber tactics. However, the findings from Genians remain unverified.

Exclusive news, data and analytics for financial market professionalsLearn more aboutRefinitiv

Illustration shows miniatures and North Korea flag

Miniatures of people with computers are seen in front of North Korea flag in this illustration taken July 19, 2023. REUTERS/Dado Ruvic/Illustration/File Photo Purchase Licensing Rights, opens new tab

Companies
Genians Inc

SEOUL, Aug 10 (Reuters) - A North Korean hacking group built large language model tools and collected software that could help automate cyberattacks, analyse stolen material and produce more convincing phishing ‌campaigns, a South Korean cybersecurity firm said on Monday.

The cybersecurity firm, Genians (263860.KQ), opens new tab, said it found evidence that the North Korean-linked group Kimsuky had set up tools for running and managing AI models locally, including Ollama, GPT4All and Msty, alongside document ⁠search technology known as retrieval augmented generation (RAG).

Jumpstart your morning with the latest legal news delivered straight to your inbox from The Daily Docket newsletter. Sign up here.

Advertisement · Scroll to continue

According to the company, the tools could allow operators to process documents without sending sensitive information to outside AI services.

Genians also found AI agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool, on infrastructure it linked to the campaign.

The findings suggest Kimsuky is moving beyond using generative AI to create phishing lures and is building capacity ‌to ⁠integrate existing AI models into malware development, data analysis and attack automation, Genians said in a report.

Genians also said it found finance and cryptocurrency-themed decoy documents that appeared to have been generated with AI. The ⁠materials were designed to resemble legitimate investment reports and other workplace documents, it said.

Advertisement · Scroll to continue

The company's findings could not be independently verified.

North Korea has for years ⁠used state-linked cyber units for espionage, financial theft and revenue generation, according to U.S. and South Korean authorities, as well ⁠as cybersecurity experts.

The U.S. Treasury in 2023 sanctioned Kimsuky, opens new tab as a North Korean government-controlled cyber-espionage group, saying it gathered intelligence in support of Pyongyang's strategic objectives.

Reporting by Joyce Lee Editing by Ed Davies

Our Standards: The Thomson Reuters Trust Principles., opens new tab