North Korean hackers Kimsuky have armed themselves with local AI for attacks on the crypto industry
An analysis of the infrastructure of the North Korean group Kimsuky has revealed a troubling trend: hackers are actively integrating local large language models (LLMs) into their attack chains targeting cryptocurrency and financial organizations. This is no longer experimentation but a full-fledged shift toward automating cybercrime with artificial intelligence.
Offline AI: A New Threat Vector
During technical reconnaissance, I managed to discover that Kimsuky has deployed environments based on Ollama, GPT4All, and Msty. A key feature is offline operation with support for Retrieval-Augmented Generation (RAG). This approach allows attackers to process sensitive data without sending requests to cloud services, minimizing the risk of exposing their operational infrastructure and making traffic less noticeable to monitoring systems.
Additionally, the group's arsenal includes libraries for embedding language models into their own software, the AI programming assistant Cursor, and speech recognition tools. This points to a comprehensive strategy: from generating malicious code to analyzing vulnerabilities and automating phishing campaigns.
Next-Generation Phishing
Of particular note is the use of generative AI to create phishing documents. Some materials mimicked official papers from a Korean AI investment platform, featuring natural language and professional formatting. This tactic significantly boosts victim trust, especially amid growing interest in digital assets and fintech services.
Notably, Kimsuky relies on ready-made open-source technologies rather than training its own models. This lowers the entry barrier and accelerates adaptation to new defense methods.
Recall that in August, the cryptocurrency exchange Bybit filed a civil lawsuit against North Korea and the Lazarus Group, underscoring the scale of the threat posed by North Korean hackers.
My verdict: The use of local LLMs marks a paradigm shift in cybercrime. Traditional sandboxes and cloud-based reputation filters are becoming less effective. The industry urgently needs to revise security protocols, focusing on behavioral analysis and anomaly detection at endpoints, not just network traffic.