The Kimsuky group is arming itself with local AI for attacks on the crypto industry.
The North Korean hacker group Kimsuky, known for its cyber operations against the financial sector, has moved to a new level of technological evolution. During an analysis of the attackers' infrastructure, my colleagues in the cybersecurity field discovered that the group is actively integrating local large language models (LLMs) into its attack chains targeting cryptocurrency companies.
Unlike cloud-based solutions that can be tracked or blocked, Kimsuky uses offline environments based on Ollama, GPT4All, and Msty. The key advantage of this approach is full autonomy. The tools support the Retrieval-Augmented Generation (RAG) method, allowing requests to be processed and content to be generated without transmitting data to external services. This makes attacks nearly invisible to traditional network traffic monitoring systems.
The group's arsenal also includes libraries and frameworks for embedding language models into its own software, indicating serious engineering effort. Of particular note is the use of the AI programming assistant Cursor and speech recognition tools. This suggests that hackers are automating not only the writing of malicious code but also the analysis of large volumes of intercepted data.
It is important to emphasize: Kimsuky has already moved beyond the experimental stage. This is not about testing AI out of curiosity, but about preparing for combat deployment. Priority is given to using ready-made open-source models rather than training proprietary neural networks from scratch. This is a pragmatic approach that sharply lowers the barrier to entry and accelerates the attack development cycle.
The phishing component deserves special attention. The group uses generative AI to create convincing documents about digital assets, investment strategies, and fintech services. Some materials were disguised as official papers from a Korean AI investment platform. Natural language and professional formatting make such emails extremely dangerous for company employees who cannot always distinguish a fake from the original.
I would add that in August, the crypto exchange Bybit already filed a civil lawsuit against North Korea and the Lazarus Group, underscoring the scale of the threat posed by North Korean cyber groups.
My comment: The use of local LLMs is a turning point. Previously, phishing could be recognized by language errors or unnatural phrasing. Now, with attackers gaining access to offline models at the level of GPT4All, the barrier to creating perfect attacks has virtually disappeared. Crypto companies should reconsider their security protocols, relying on multi-factor authentication and staff training rather than only technical defense measures.