Kimsuky integrates local AI models into cyberattacks on the crypto industry
The North Korean hacker group Kimsuky, known for its years-long operations against the financial sector, has moved to a new level of technological sophistication. An analysis of the attackers' infrastructure conducted by cybersecurity specialists revealed the active use of local large language model (LLM) environments based on Ollama, GPT4All, and Msty. These tools operate fully offline, allowing operators to process data without sending it to cloud services, minimizing the risk of detection.
A key feature of the discovered systems is support for the Retrieval-Augmented Generation (RAG) methodology. This means hackers can query and analyze information from their own databases without relying on external APIs, which is critical for maintaining anonymity and operational security. Additionally, the group's arsenal includes libraries and frameworks for integrating language models into their own malware, as well as the Cursor AI assistant for programming and speech recognition tools.
What is particularly alarming is not just experimentation with AI, but the systematic integration of these technologies into real attack chains. This involves automating data analysis, generating code for malicious programs, and increasing the effectiveness of phishing campaigns. Instead of training their own models from scratch, Kimsuky is betting on adapting ready-made open-source solutions, which significantly accelerates the development cycle and lowers the entry barrier for complex operations.
It is also worth noting the quality of the generated phishing materials. The attackers create documents that mimic official papers from South Korean AI investment platforms, with professional formatting and natural language. This indicates a high level of automation in social engineering targeting employees of cryptocurrency and fintech companies, as well as private investors.
Notably, in August of this year, the cryptocurrency exchange Bybit filed a civil lawsuit against North Korea and the Lazarus Group. However, as practice shows, Kimsuky continues to evolve, and current findings underscore the growing threat from state-sponsored hackers using advanced technologies to bypass traditional defense measures.
My comment: The use of local LLMs is a strategic shift in APT group tactics. The offline environment eliminates dependence on external providers and makes traffic virtually invisible to monitoring systems. The industry should expect a wave of more sophisticated attacks where AI will be used not only for phishing but also for autonomous vulnerability discovery in code. Crypto companies need to rethink their security protocols, focusing on behavioral analysis and network segmentation rather than just signature-based detectors.