The DPRK is taking cyberwarfare to a new level: Kimsuky is mastering AI to automate attacks
The North Korean hacker group Kimsuky, operating under the auspices of the Reconnaissance General Bureau of the DPRK General Staff, is transitioning from simple use of generative AI to the systematic integration of this technology into its cyberattacks. My analysis shows that this is no longer a set of scattered experiments, but a well-thought-out strategy to modernize the entire hacking cycle—from malware development to the automation of phishing campaigns.
During the technical investigation, it was discovered that Kimsuky is actively mastering tools for running AI models locally, including Ollama, GPT4All, and Msty. This approach is not accidental: local data processing minimizes the risk of confidential information and stolen data leaking to external cloud services. Additionally, the hackers are using retrieval-augmented generation (RAG) technology, which allows AI models to quickly retrieve and analyze information from selected documents.
Toolkit for a New Era of Cyberattacks
An entire arsenal has been found on the group's associated infrastructure: frameworks for AI agents, speech-to-text transcription software, and Cursor—an AI-powered code editor. In my assessment, such a set indicates that Kimsuky is preparing for full automation of processes: from generating code for malware to analyzing large data sets and coordinating attacks. This is not about trivial creations, but about building a pipeline for producing cyber threats.
It is worth noting that the group has previously used AI to create fake financial and cryptocurrency lure documents imitating investment reports. Now, based on the collected data, it can be asserted that Kimsuky is systematically studying ways to practically implement AI, starting with malware development and ending with the refinement of hacking methods. At the same time, despite active research, no traces of training their own models have been found yet—the group relies on ready-made solutions.
Of particular concern is the combination of AI with attacks on the crypto industry. In 2025 alone, North Korean groups stole $2.02 billion in cryptocurrency. RAG technology allows data to be extracted from stolen documents, while speech recognition systems convert audio intercepts into searchable text. This dramatically increases the effectiveness of espionage and fund theft.
My expert opinion: the integration of AI into Kimsuky's arsenal is not just another turn in the cyber arms race. It is a signal that state-sponsored hackers are beginning to use AI as a full-fledged tool for scaling attacks. Crypto exchanges and financial institutions urgently need to review their defense systems, as AI-based automated attacks are capable of bypassing traditional signatures and adapting to countermeasures more quickly. We are on the threshold of a new era where the speed and complexity of cyber threats will grow exponentially.