Kimsuky raises the bar: North Korean hackers arm themselves with local AI for attacks on the crypto industry
The North Korean hacker group Kimsuky, known for its audacious operations against the financial sector, is radically modernizing its arsenal. Instead of traditional phishing schemes and vulnerability exploitation, the attackers are now actively deploying local artificial intelligence systems to conduct attacks on cryptocurrency and financial companies. This is no longer just experimentation, but a full-fledged combat integration of AI into cybercriminal infrastructure.
During an analysis of the group's infrastructure, I managed to identify the use of local environments based on Ollama, GPT4All, and Msty. A key feature of these tools is their offline operation with support for the Retrieval-Augmented Generation methodology. This means hackers can process sensitive data and generate attack vectors without sending requests to cloud services, which completely eliminates the possibility of traffic interception and detection by security systems. This approach makes their operations practically invisible to traditional monitoring tools.
However, the North Korean specialists did not stop there. Their arsenal also includes libraries and frameworks for embedding language models directly into their own malware, as well as the AI coding assistant Cursor and speech recognition tools. This indicates a comprehensive approach: from automating code writing to analyzing large volumes of data and enhancing the effectiveness of social engineering.
Particularly noteworthy is the fact that Kimsuky has already moved from the testing stage to the practical use of generative AI to create phishing materials. I discovered documents mimicking a Korean AI investment platform, with professional design and natural language that are difficult to distinguish from legitimate ones. This is a serious signal for the entire industry: attacks are becoming personalized and high-tech.
In my assessment, the group's priority is to use ready-made solutions rather than develop their own models, which allows them to scale attacks quickly. At the same time, ongoing lawsuits, such as the Bybit lawsuit against North Korea, are unlikely to stop this escalation. Crypto companies urgently need to review their security protocols, betting on behavioral analysis and protection against AI threats, otherwise the next wave of attacks could be fatal.