North Korean hackers Kimsuky are mastering AI: a new era of cyberattacks
The Kimsuky group, operating under the auspices of North Korean intelligence, has shifted from simply using generative neural networks to systematically integrating AI into its attack chains. These are no longer scattered experiments, but a full-fledged strategy to modernize cyber weapons.
My analysis shows that Kimsuky is actively testing local tools for running AI models, including Ollama, GPT4All, and Msty. This approach is not accidental: local data processing minimizes the risk of confidential information leaking to external cloud services, which is critical for a group operating under conditions of total isolation.
Technological arsenal: from RAG to Cursor
Not only frameworks for running models have been found in the attackers' infrastructure, but also more advanced solutions. This refers to retrieval-augmented generation (RAG) technology, which allows AI to access specific documents, as well as speech recognition systems for converting audio files into text. Additionally, the hackers use Cursor, an AI-powered code editor, which points to the automation of malware development.
In my assessment, such a set of tools indicates Kimsuky's desire to embed AI into all stages of an attack: from writing code to analyzing exfiltrated data. This is no longer just phishing with fake documents created by neural networks, but comprehensive automation of intelligence activities.
Cryptocurrency trail and risks for the industry
Of particular concern is the group's activity in the cryptocurrency sector. Previously, Kimsuky used AI to create fake financial lure documents mimicking investment reports. These files target directors and engineers at crypto companies. According to industry data, North Korean groups stole $2.02 billion in cryptocurrency in 2025, and AI tools only enhance their capabilities.
The key risks I see: RAG technology allows extracting data from stolen documents, and speech recognition systems convert intercepted audio recordings into easily searchable text. This poses a serious threat to the confidentiality of corporate communications.
For now, research shows that Kimsuky's work with AI is at the stage of data accumulation and capability exploration—no traces of training their own models have been found. However, this is only a matter of time. North Korean hackers are methodically preparing the ground for the full-scale use of AI in their operations, and the cybersecurity industry should prepare for a new wave of attacks.
My expert opinion: the adoption of local AI tools is a strategic move that makes Kimsuky's attacks less predictable and more autonomous. Crypto exchanges and funds should review their security protocols, paying special attention to verifying documents and audio recordings that may be generated by artificial intelligence.