North Korean hackers have armed themselves with local AI to strike at the crypto industry.
An analysis of the infrastructure of the North Korean group Kimsuky has revealed a troubling trend: hackers are actively integrating local large language models into their attack chains. This is no longer experimentation, but a full-scale rearmament of cybercriminals targeting cryptocurrency exchanges and fintech services.
Offline AI: A New Frontier in Hacker Defense
Kimsuky's arsenal includes local LLM environments based on Ollama, GPT4All, and Msty. The key feature is full autonomy. These systems operate offline and use the Retrieval-Augmented Generation (RAG) method, allowing them to process queries without transmitting data to cloud services. This is critically important for attackers: it lets them avoid leaks through third-party channels and leaves no digital traces in cloud provider logs.
In addition to the models themselves, the group's infrastructure contains libraries and frameworks for embedding AI into their own software, as well as speech recognition tools and the AI-assisted programming tool Cursor. This indicates that Kimsuky is automating not only phishing but also the development of malicious code.
From Tests to Real Attacks
In my assessment, the shift from "trial" integrations to combat use of AI is a logical step for groups like Kimsuky. Instead of the costly process of training their own models, they adopt ready-made open-source solutions that are easy to adapt to specific tasks. The priority is speed and efficiency, not innovation.
Of particular note is the use of generative AI to create phishing documents. Some materials mimicked official papers from a Korean AI platform for investments. The texts featured natural language and professional formatting, making them nearly indistinguishable from legitimate ones. This poses a serious challenge for spam filtering systems and employee training.
Context and Conclusions
Recall that in August, the crypto exchange Bybit filed a civil lawsuit against North Korea and the Lazarus Group. Now we see that Kimsuky, operating in conjunction with Lazarus, is expanding its technological capabilities, using AI to enhance the precision and scalability of its attacks. Crypto companies should reconsider their security protocols, paying special attention to verifying incoming documentation and monitoring anomalies in network traffic that could be generated by offline AI.
Personally, I expect that in the coming months we will see a rise in attacks where AI is used not only for phishing but also for automated vulnerability discovery in smart contracts. This changes the rules of the game in crypto industry cybersecurity, and action needs to be taken now.