A North Korean hacking group has built its own tools for running large language models and is assembling software that could automate cyberattacks, analyse stolen material and craft more convincing phishing campaigns, South Korean cybersecurity firm Genians said on Monday.
Genians said it found evidence that the state-linked group Kimsuky had set up infrastructure for running and managing AI models locally — including Ollama, GPT4All and Msty — alongside retrieval-augmented generation (RAG) technology for searching documents. Operating models locally would let operators process documents without sending sensitive information to outside AI services.
The firm also found AI agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool, on infrastructure linked to the campaign.
The findings suggest Kimsuky is moving beyond using generative AI to create phishing lures and is building the capacity to integrate existing AI models into malware development, data analysis and attack automation, Genians said in a report.
It also said it found finance- and cryptocurrency-themed decoy documents that appeared to have been generated with AI, designed to resemble legitimate investment reports and workplace documents. The findings could not be independently verified.
The U.S. Treasury sanctioned Kimsuky in 2023 as a North Korean government-controlled cyber-espionage group, saying it gathered intelligence in support of Pyongyang's strategic objectives. North Korea has for years used state-linked cyber units for espionage, financial theft and revenue generation, according to U.S. and South Korean authorities.
