North Korea is arming itself with AI: the Kimsuky group is mastering generative models for cyberattacks.
The North Korean hacker group Kimsuky, operating under the auspices of the Reconnaissance General Bureau of the DPRK General Staff, has reached a new level of digital weaponry. My analysis of fresh cyber threat data shows that the attackers are actively experimenting with local artificial intelligence tools, seeking to integrate them into their attacks. This is not merely an interest in technology, but a systematic effort to modernize their arsenal.
Local AI as a Tool of Conspiracy
During technical reconnaissance, it was discovered that Kimsuky has deployed and configured several frameworks for running AI models locally—specifically, Ollama, GPT4All, and Msty. This approach is no accident: processing data on their own infrastructure minimizes the risk of confidential or stolen information leaking to external cloud services. This is a direct ploy to bypass monitoring systems and maintain stealth.
Furthermore, retrieval-augmented generation (RAG) technologies have been detected on infrastructure linked to the group, allowing AI models to access specific documents. Alongside this, speech recognition and translation tools have been found, as well as Cursor—an AI-powered code editor. Such a toolkit suggests that the hackers are preparing for a full cycle: from generating malware to automating data analysis and attacks.
From Lures to Automation
Previously, Kimsuky had already used AI to create fake financial and cryptocurrency lure documents imitating investment reports. Now, the focus is shifting toward deeper integration. In my assessment, the group is aiming not at one-off experiments, but at building a sustainable system where AI becomes the driving force behind cyber operations.
Of particular concern is the fact that North Korean hackers, including Kimsuky, are actively attacking the crypto industry. In 2025 alone, such groups have stolen over $2.02 billion in digital assets. RAG technology allows them to efficiently extract data from stolen documents, while speech recognition systems turn audio recordings into searchable text. This accelerates intelligence gathering and increases the precision of subsequent strikes.
It is important to emphasize: so far, no traces of training their own AI models have been found, and Kimsuky's activities are limited to research and data accumulation. But this is only a matter of time. The arms race in cyberspace is entering a new phase, and industries, especially the crypto sector, urgently need to adapt their defensive strategies to threats where AI is used as offensive weaponry.
My opinion: the shift of North Korean hackers to local AI tools is a signal for all market participants. Vulnerabilities will grow exponentially, and reliance on traditional security methods is no longer relevant. Investors and companies should reconsider their protection protocols, focusing on AI-driven threat analytics and behavioral anomalies.