North Korean Hackers Deploy Local AI Tools, Targeting Crypto

Kimsuky is reportedly building local AI capabilities that could make crypto-focused phishing and social engineering easier to scale.

North Korea’s hackers have spent years targeting the cryptocurrency industry. Now, cybersecurity researchers say one of its hacking groups, Kimsuky, is building local AI infrastructure that could make those attacks cheaper and easier to scale.

The findings, reported by South Korean cybersecurity firm Genian Security Center, point to a broader shift from using AI to write phishing messages toward integrating AI into attack infrastructure.

According to Genians, researchers identified local deployments of AI tools including Ollama, GPT4All and Msty, as well as retrieval-augmented generation (RAG) technology.

Running AI systems locally could allow attackers to process sensitive information without sending it to an external AI provider. That may be relevant when handling stolen emails, internal documents or other data obtained during an intrusion.

Genians also identified AI-agent frameworks, speech-to-text software and Cursor, an AI-assisted coding tool, on infrastructure linked to Kimsuky. The cybersecurity firm said the setup could support activities including malware development, data analysis and attack automation.

The firm also reported finding finance- and cryptocurrency-themed documents that appeared to have been generated or assisted by AI. The documents were designed to resemble legitimate investment reports and workplace materials, according to Genians.

The findings suggest that Kimsuky may be moving beyond using generative AI primarily for creating individual phishing lures and toward incorporating AI tools into a broader operational workflow. Genians said this could include malware development, analysis of stolen data and automation of parts of cyber operations.