Kimsuky builds AI cyberattack tools

South Korean cybersecurity firm Genian Inc. reported on August 10 that the North Korean-linked hacking group Kimsuky has built large language model tools and collected software to automate cyberattacks, analyze stolen data, and create more convincing phishing campaigns. Genian Inc. found evidence that Kimsuky set up local AI model management tools including Ollama, GPT4All, and Msty, along with retrieval augmented generation (RAG) technology, AI agent development frameworks, speech-to-text software, and the AI-assisted coding tool Cursor. The findings suggest Kimsuky is expanding beyond using generative AI for phishing lures to integrating AI models into malware development, data analysis, and attack automation. Genian Inc. also found finance and cryptocurrency-themed decoy documents generated with AI, designed to resemble legitimate investment reports. The findings could not be independently verified. North Korea has long used state-linked cyber units for espionage and financial theft, and the U.S. Treasury sanctioned Kimsuky in 2023 as a government-controlled cyber-espionage group.