North Korean hackers are embedding offline AI into attacks on the crypto industry.
An analysis of the infrastructure of the North Korean hacker group Kimsuky has revealed a new tactic: the use of local large language models (LLMs) for cyberattacks on cryptocurrency and financial organizations. This is not just experimentation, but a systematic shift toward autonomous tools that operate in offline mode.
During the technical investigation, I discovered that the attackers deployed environments based on Ollama, GPT4All, and Msty. A key feature is support for the Retrieval-Augmented Generation (RAG) methodology. This allows requests to be processed without transmitting data to cloud services, which is critical for maintaining the hackers' operational security. This approach minimizes traces and eliminates traffic interception.
In addition, the group's arsenal includes libraries and frameworks for integrating language models into their own software, as well as the AI programming assistant Cursor and speech recognition tools. This indicates that Kimsuky is actively automating the full attack cycle: from generating malicious code to analyzing collected data.
From testing to combat deployment
Judging by the current dynamics, the group has already moved beyond the pilot project stage. This is about embedding ready-made open-source LLMs into real attack chains, rather than developing their own models, which would require significant computing resources. The priority is speed and efficiency.
Of particular note is the use of generative AI to create phishing materials. I analyzed samples of documents imitating a Korean AI platform for investments. They feature a high degree of realism: natural language, professional layout, and deep elaboration of digital asset and fintech topics. This is a serious escalation of the threat, as even experienced users may not be able to distinguish a fake from the original.
My assessment: Kimsuky's transition to local AI solutions is a strategic move that lowers the entry barrier for large-scale campaigns. Crypto companies should reconsider their security protocols, focusing on behavioral analysis and verification of incoming documents, especially when it comes to financial offers or investment strategies. Traditional signatures will no longer help here.