North Korea's Kimsuky integrates AI into cyberattacks targeting crypto and finance

North Korean hacker group Kimsuky is using local AI systems to target cryptocurrency and financial firms with sophisticated cyberattacks, according to a report released Monday by Genians.

The South Korean cybersecurity firm found evidence that the group built and operated three local large language model (LLM) environments using Ollama, GPT4All, and Msty. 

These tools allow offline operation and support retrieval-augmented generation, enabling hackers to make queries without sending data to external cloud services.

The group has also collected libraries and frameworks to embed language models into custom software, along with the AI coding assistant Cursor and speech-to-text tools. Genians said this activity focused on integrating existing open-source AI models into malware development, data analysis, and attack automation.

"This provides concrete evidence that the Kimsuky-affiliated threat actor is moving beyond one-off experimentation with AI and is continuously preparing to integrate the technology into actual attack capabilities," Genians noted.

Nonetheless, the research firm stated that Kimsuky appears to remain focused on the integration of existing AI technologies rather than creating entirely new AI models from scratch.

Attack on crypto

At the same time, Genians said it found evidence that Kimsuky continues to use generative AI to produce polished phishing documents themed around digital assets, investment strategies, and fintech services.

Some documents closely imitated materials from a Korean AI-powered investment platform, featuring natural language, consistent, and professional formatting, and design elements typical of AI-generated content.

Genians

North Korean hackers stole $2.02 billion worth of cryptocurrency last year, including the $1.5 billion hack of Bybit crypto exchange, according to Chainalysis. The attack methods span from simple phishing emails to embedding IT workers inside crypto services to target sensitive internal data.

Hackers are becoming ever more sophisticated with the advent of AI — NEAR Protocol Co-founder Illia Polosukhin said that AI is supercharging hackers' ability to find software vulnerabilities faster than traditional security can patch them.

The recent $100 million exploit of Coldcard bitcoin hardware wallets is suspected to stem from an obscure vulnerability that AI uncovered.