North Korean hackers have armed themselves with local AI to attack the crypto industry.
An analysis of the infrastructure of the North Korean hacking group Kimsuky, conducted by cybersecurity experts, has revealed a worrying trend: attackers are actively integrating local large language models (LLMs) into their attack chains targeting cryptocurrency and financial organizations.
Offline tools as new weapons
During technical reconnaissance, deployed environments based on open platforms such as Ollama, GPT4All, and Msty were discovered. The key feature of these solutions is full autonomy. They operate offline, allowing operators to use the Retrieval-Augmented Generation (RAG) method to process queries without transmitting data to cloud services. This fundamentally changes the game, as traditional detection methods based on network traffic monitoring become less effective.
In addition to the models themselves, the group's arsenal includes libraries and frameworks for embedding AI into their own software, as well as specialized tools, including the AI coding assistant Cursor and speech recognition systems. This combination points to serious process automation: from generating malicious code to analyzing vulnerabilities and coordinating attacks.
From experiments to combat deployment
It is important to emphasize that this is not about test runs. The observed activity indicates a transition to the practical use of AI in real operations. Priority is given to borrowing ready-made technologies rather than developing proprietary models from scratch, which significantly accelerates the cycle of creating new threats.
Particular attention is drawn to the use of generative AI to create phishing materials. The generated documents mimic legitimate documentation concerning digital assets and investment strategies, with some of them styled after materials from well-known South Korean AI platforms. Natural language and professional formatting make these emails extremely convincing, increasing the likelihood of successfully breaching corporate systems.
It is worth recalling that in August of this year, the cryptocurrency exchange Bybit filed a civil lawsuit against North Korea and the Lazarus Group, highlighting the growing legal and operational activity surrounding North Korean cyber threats.
My comment: The use of local LLMs is a logical step in the evolution of cybercrime. It reduces dependence on external infrastructure and makes attacks more covert. The industry should reconsider its threat models, placing more emphasis on behavioral analysis and endpoint protection rather than just network perimeters.