Kimsuks moves to a new level: North Korean hackers arm themselves with local AI for strikes on the crypto industry
The world of digital assets has faced a new threat that is changing the rules of the game in cybersecurity. The Kimsuky group, operating in the interests of North Korea, has shifted from traditional hacking methods to using local artificial intelligence systems to attack cryptocurrency and financial structures. This is not just rumors — my research confirms that hackers are actively integrating LLM environments based on Ollama, GPT4All, and Msty into their infrastructure.
The key feature of these tools is full autonomy. They work offline, allowing attackers to use the Retrieval-Augmented Generation method without the risk of data leakage through cloud services. This means their operations become almost invisible to traditional monitoring systems. The group's arsenal also includes libraries for embedding language models into their own software, the Cursor AI programming assistant, and speech recognition tools.
From experiments to real attacks
It is important to emphasize that Kimsuky is no longer just testing AI capabilities. This is about full-scale preparation for integrating these technologies into combat tools. Priority is given to using ready-made solutions rather than developing their own models — this significantly speeds up the process and reduces the costs of preparing attacks.
Of particular concern is the use of generative AI to create phishing materials. I have managed to identify that the group generates documents about digital assets, investment strategies, and fintech services that mimic official papers from a Korean AI investment platform. These materials feature natural language and professional formatting, making them almost indistinguishable from legitimate ones.
The situation is compounded by the fact that in August, the Bybit crypto exchange already filed a civil lawsuit against North Korea and the Lazarus Group, confirming the scale of the threat. However, in my view, the industry underestimates the speed at which North Korean hackers adapt to new technologies. The use of local AI is not just a trend but a strategic move that allows them to bypass international sanctions and stay in the shadows. Crypto companies urgently need to reconsider their security protocols, paying special attention to protection against AI-generated phishing attacks, which are becoming increasingly sophisticated and personalized.