North Korean hackers from Kimsuky have armed themselves with local AI to strike at the crypto industry.
An analysis of the infrastructure of the North Korean hacker group Kimsuky, conducted by cybersecurity experts, has revealed a troubling trend: the attackers are actively integrating local large language models (LLMs) into their attack chains targeting cryptocurrency and financial organizations.
Unlike cloud services, these AI environments, deployed on open-source platforms such as Ollama, GPT4All, and Msty, operate entirely offline. This approach allows hackers to use the Retrieval-Augmented Generation (RAG) method to process data and generate content without sending sensitive information to external clouds or risking being tracked through network requests. This makes their operations significantly more covert and autonomous.
During the technical analysis, libraries and frameworks for embedding language models directly into their own malware were also discovered, along with tools for automating programming and speech recognition. It appears that Kimsuky has already moved past the experimentation stage and shifted to the practical integration of AI into its combat tools, betting on the use of ready-made solutions rather than building their own models from scratch.
Particular attention is drawn to the use of generative AI to create phishing materials. The generated documents, imitating legitimate reports on digital assets, investment strategies, and fintech services, stand out for their high language quality and professional formatting. In several cases, they masterfully copied documentation from Korean AI investment platforms, making them nearly indistinguishable from the real thing.
This confirms that North Korean groups, including the infamous Lazarus Group, against which the Bybit crypto exchange has already filed a civil lawsuit, are not just tracking technological trends but are actively arming themselves with them to enhance the effectiveness of their attacks.
My comment: The use of local LLMs is a significant step in the evolution of cyber threats. This not only improves the quality of phishing but also seriously complicates the work of security systems, which often rely on analyzing network anomalies when interacting with cloud AI services. Crypto companies should reconsider their protection protocols, focusing on behavioral analysis and multi-factor authentication rather than just filtering incoming emails.