Kimsuky: North Korean hackers have armed themselves with local AI to strike the crypto industry.
The Kimsuky group, operating in the interests of North Korea, is radically changing its tactics: instead of traditional phishing schemes, it is actively deploying local artificial intelligence models to attack cryptocurrency and financial structures. This is the conclusion reached by cybersecurity experts from Genians during an analysis of the attackers' infrastructure.
Offline AI: A New Threat to Digital Assets
Local LLM environments based on Ollama, GPT4All, and Msty have been discovered in Kimsuky's arsenal. The key feature of these tools is full autonomy. They operate offline and use the Retrieval-Augmented Generation method, allowing hackers to process data and generate content without sending requests to cloud services. This makes their activity virtually invisible to monitoring systems that are accustomed to tracking network anomalies.
In addition to language models, the group's infrastructure contains frameworks for integrating AI into their own software, the Cursor programming assistant, and speech recognition tools. Such a set indicates a systematic approach: Kimsuky is not just experimenting with the technology but preparing it for combat use—from automating attacks to analyzing large data arrays.
Next-Generation Phishing
Of particular concern is the use of generative AI to create phishing materials. Documents imitating Korean investment platforms and fintech services feature impeccable language and professional design. They are so high-quality that even an experienced eye does not immediately recognize a fake. This is not just evolution—it is a leap in the threat level, where AI becomes a weapon of mass destruction for user trust.
It is important to emphasize: Kimsuky is betting on ready-made solutions rather than training its own models. This makes their operations cheaper and faster, rendering attacks more frequent and sophisticated. While the cryptocurrency industry is focused on defending against the Lazarus Group, Kimsuky is quietly building its potential, and this requires an immediate revision of security strategies.
My assessment: the market underestimates the speed of APT groups' adaptation to AI. Local models are just the first step; the next will be autonomous agents capable of making decisions in real time on their own. Crypto companies should invest in AI defense today, or tomorrow they will face an adversary that thinks faster and acts more covertly.