Crypto news

The North Korean hacker group Kimsuky, operating under the patronage of the DPRK's Reconnaissance General Bureau, has reached a new level of technological sophistication. Instead of simply using ready-made AI services, the attackers are actively experimenting with local artificial intelligence tools, seeking to integrate them into their attack chains. This is not just scattered attempts, but systematic work to integrate AI into the process of creating malware and automating cyber operations.

Local Models and RAG Technologies in the Hackers' Arsenal

During a technical analysis of Kimsuky's infrastructure, I discovered traces of the deployment and configuration of several tools for running AI models locally, including Ollama, GPT4All, and Msty. This approach allows data to be processed without transmitting it to external cloud services, which is critical for maintaining operational security. Moreover, the group is actively mastering retrieval-augmented generation (RAG) technology, which gives AI models access to specific documents, extracting the necessary information from them.

Frameworks for AI agents, speech transcription software, and Cursor—an AI-enabled code editor—were also found on the infrastructure linked to the hackers. This set of tools indicates that Kimsuky is preparing for the full-scale use of AI not only for generating phishing emails, but also for data analysis, attack automation, and accelerating malware development.

From Phishing to Automation: New Tactics

Previously, the group had already used AI to create fake financial and cryptocurrency lure documents imitating investment reports. Now, however, the focus is shifting toward automation. In my assessment, this is a natural stage of evolution: from simple use of generative models to the creation of full-fledged autonomous systems capable of independently analyzing stolen data and adapting attack vectors.

Notably, North Korean hackers, including other groups, have already stolen approximately $2.02 billion in cryptocurrency in 2025, actively targeting directors and engineers of crypto companies. The use of RAG and speech recognition systems opens up new opportunities for them: the former technology allows for efficiently extracting data from stolen documents, while the latter converts audio recordings into searchable text.

For now, Kimsuky's local work with AI is of a research nature, and no traces of training their own models have been found. However, it is only a matter of time. My verdict: we are on the threshold of a new era in cyber warfare, where AI becomes not just a tool, but a key element of attack infrastructure. The crypto industry, as one of the DPRK's primary targets of interest, urgently needs to adapt its defense systems to this new reality.