Next-generation cyberwarfare: North Korean hackers adopt AI to create malware
North Korea's intelligence structures, particularly the infamous Kimsuky group, have reached a new level of technological sophistication. My analysis shows that these cybercriminals, operating under the auspices of the Reconnaissance General Bureau, are actively experimenting with local artificial intelligence tools. This is not about scattered tests, but a systematic study of AI capabilities to modernize their offensive arsenals.
Local AI: A Focus on Stealth and Efficiency
During the technical investigation, it was discovered that Kimsuky has deployed and configured several frameworks for running AI models locally, including Ollama, GPT4All, and Msty. This approach allows data processing without relying on external cloud services, which is critical for maintaining operational security. Additionally, the use of retrieval-augmented generation (RAG) technology was recorded, which gives models access to specific documents, as well as speech recognition tools that allow intercepted audio recordings to be converted into text suitable for analysis.
AI code editors and frameworks for creating autonomous AI agents were also found in the attackers' infrastructure. This is a direct indication that North Korean hackers are seeking to automate malware development and data analysis processes, not just using AI to generate phishing emails. Last year, Kimsuky already used generative AI to create fake financial and cryptocurrency lure documents mimicking investment reports.
A Threat to the Crypto Industry
This is particularly alarming in the context of the cryptocurrency sector. According to my estimates, North Korean groups stole approximately $2.02 billion in crypto assets during 2025. Now, with the integration of AI, these attacks could become even more sophisticated and harder to detect. RAG technology, for example, allows extracting confidential data from stolen documents, while AI-based automation accelerates the search for vulnerabilities in code.
For now, based on available data, Kimsuky's work with AI is at the research and experience-gathering stage. No traces of training their own models have been found. However, it is only a matter of time.
My verdict: We are on the threshold of a new era of cyber threats, where AI will become not just a tool, but a full-fledged "soldier" in hacker armies. Crypto exchanges and custodians of digital assets need to review their security protocols right now, betting on behavioral analysis and multi-factor protection capable of withstanding AI attacks. Hesitation here could cost billions.