Kimsuky integrates local AI models into attacks on the crypto industry
The North Korean hacker group Kimsuky, known for its targeted cyberattacks, has moved to a new level of technological sophistication. My colleagues in the cybersecurity field have recorded the group's use of local large language models (LLMs) to attack cryptocurrency and financial organizations. This is not just an experiment, but a systematic approach to modernizing its attack toolkit.
During an analysis of Kimsuky's infrastructure, local AI environments deployed on open-source platforms such as Ollama, GPT4All, and Msty were discovered. The key feature of these solutions is full autonomy. They operate offline, and the Retrieval-Augmented Generation (RAG) method allows processing requests without transmitting data to cloud services, making the group's traffic nearly invisible to monitoring systems.
The group's technological arsenal
In addition to LLMs, libraries and frameworks for integrating language models into their own software were found in the attackers' infrastructure. Of particular note is the use of the AI programming assistant Cursor and speech recognition tools. This indicates that Kimsuky is automating not only the writing of malicious code, but also the processes of data analysis and social engineering.
In my assessment, the group has already moved past the testing stage. Based on the components found, there is active preparation to embed AI into real combat tools. Priority is given to using ready-made open-source technologies rather than developing proprietary models from scratch—this saves resources and accelerates adaptation.
Of particular note is the use of generative AI to create phishing materials. The group generates documents that mimic legitimate files about digital assets, investment strategies, and fintech services. Some samples were crafted so convincingly that they replicated the design of a Korean AI investment platform, with natural language and professional formatting. This poses a serious challenge to spam filtering systems.
In the context of recent legal actions against North Korea, including Bybit's lawsuit against the Lazarus Group, Kimsuky's activity underscores the growing threat from state-sponsored hackers. Crypto companies need to review their security protocols in light of AI-assisted attacks.
My comment: The use of local LLMs is a logical step in the evolution of cybercrime. Full autonomy and the impossibility of data interception make such attacks especially dangerous. The industry should expect that in the coming years, such methods will become the standard for advanced APT groups, and defenses must be built with this scenario in mind.