North Korean hackers Kimsuky have armed themselves with local AI for attacks on the crypto industry.
An analysis of the infrastructure of the North Korean hacking group Kimsuky has revealed a troubling trend: attackers are actively integrating local large language models (LLMs) into their attack chains. This is not a simple experiment, but a systematic deployment of AI in real operations against cryptocurrency and financial companies.
Offline AI as a New Weapon
During a technical breakdown, specialists discovered that Kimsuky has deployed environments based on Ollama, GPT4All, and Msty. The key feature of these tools is their complete autonomy. They operate offline and support the Retrieval-Augmented Generation (RAG) method, allowing hackers to process queries without transmitting data to cloud services. This significantly reduces the risk of detection and makes the group's traffic less noticeable to monitoring systems.
In addition, the group's arsenal includes libraries for embedding language models into their own software, the AI programming assistant Cursor, and speech recognition tools. This set indicates a comprehensive approach: from automating malicious code writing to analyzing large data arrays and generating plausible phishing materials.
Generative AI in Phishing
Particular attention is drawn to the use of generative models to create documents about digital assets, investment strategies, and fintech services. Some of these materials imitated official papers from a Korean AI investment platform. The final versions featured natural language and professional formatting, making them nearly indistinguishable from legitimate ones.
According to expert estimates, Kimsuky has moved from the "trial" stage to practical preparation. The priority is using ready-made open-source technologies rather than training their own models, which speeds up the development cycle and reduces costs.
Recall that in August, the cryptocurrency exchange Bybit filed a civil lawsuit against North Korea and the Lazarus Group, highlighting the scale of the threat posed by North Korean state-sponsored hackers.
My comment: Kimsuky's transition to local LLMs is a logical step in the evolution of cyber threats. Using offline models not only increases stealth but also allows for automating attack personalization on a scale unattainable by humans. Crypto companies should reconsider their security protocols, paying special attention to verifying incoming documentation and behavioral analysis, rather than relying solely on signature-based detection methods.