North Korean hackers have armed themselves with local AI to attack the crypto industry.
Analysis of the latest cyber threats shows that the North Korean group Kimsuky is radically modernizing its arsenal, integrating local artificial intelligence systems into operations against cryptocurrency and financial structures. These are not just experiments, but a full-fledged transition to using offline LLMs to increase the effectiveness and stealth of attacks.
During a technical investigation of the attackers' infrastructure, deployed environments based on Ollama, GPT4All, and Msty were discovered. The key feature of these tools is operation without cloud data transmission, which allows hackers to process sensitive information fully autonomously. Of particular interest is support for the Retrieval-Augmented Generation methodology, which enables extracting and using relevant data from local databases without leaving digital traces in external services.
Next-Generation Technical Arsenal
In addition to language models, libraries and frameworks for embedding AI into their own software, as well as speech recognition tools, were found in the group's arsenal. Notably, the use of Cursor — an AI assistant for programming — indicates automation of the malicious code development process. This suggests that Kimsuky is not just testing technologies, but actively preparing them for combat use in real cyberattacks.
Of particular concern is the group's priority strategy: using ready-made open-source LLMs instead of training their own models. This approach significantly lowers the entry barrier and accelerates adaptation to new defense mechanisms. Generative AI is already being actively used to create phishing documents imitating materials about digital assets, investment strategies, and fintech services. Some samples were so high-quality that they copied the style and design of Korean investment platforms, deceiving victims with a professional level of execution.
Let me remind you that in August, the cryptocurrency exchange Bybit filed a civil lawsuit against North Korea and the Lazarus Group, which underscores the scale of the threat. However, current findings demonstrate that North Korean hackers are evolving faster than many expected.
My assessment: The use of local AI models is a strategic breakthrough in cybercriminal tactics. This not only increases the complexity of attack detection, but also creates a precedent where AI becomes not an auxiliary, but a key element of the attacking infrastructure. Crypto companies need to reconsider their security protocols, paying special attention to behavioral analysis and anomaly detection, rather than just signature-based methods.