North Korean hacking group builds AI tools to automate cyberattacks: Report

North Korea AI cyberattacks: The tools could allow operators to process documents without sending sensitive information to external AI services, the report said

A hacking group based in North Korea has developed large language model (LLM) tools and collected software that could help automate cyberattacks, analyse stolen data and create more convincing phishing campaigns, a report by South Korean cybersecurity firm Genians said on Monday.

 

The firm said it found evidence that Kimsuky, a North Korean-linked hacking group, had set up tools for running and managing AI models locally, including Ollama, GPT4All and Msty, alongside document search technology known as retrieval-augmented generation (RAG), Reuters reported.

 

The tools could allow operators to process documents without sending sensitive information to external AI services, Genians said.

 

 

Genians also found AI agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool, on infrastructure linked to the campaign.

 

The findings suggest Kimsuky is moving beyond using generative AI to create phishing lures and is building the capacity to integrate existing AI models into malware development, data analysis and attack automation, Genians said in its report.

 

The cybersecurity firm also said it found finance- and cryptocurrency-themed decoy documents that appeared to have been generated using AI. The materials were designed to resemble legitimate investment reports and other workplace documents, it said.

 

The findings could not be independently verified, the Reuters report said. 

 

North Korea’s growing use of AI in cyber operations

 

North Korea has for years used state-linked cyber units for espionage, financial theft and revenue generation, according to US and South Korean authorities, as well as cybersecurity experts.

 

A Genians report published in September 2025 found that the Kimsuky espionage group had used OpenAI’s ChatGPT to generate a realistic fake military identification card as part of a phishing campaign to target South Korean targets. The AI-generated ID was used to make phishing emails appear more credible, while malicious attachments deployed backdoors and extracted data, the report said.

 

The findings point to a broader expansion in North Korea’s use of AI for cyber operations, from generating deepfakes and phishing material to supporting other forms of social engineering, according to Genians. 

 

The US Treasury sanctioned Kimsuky in 2023, designating it as a North Korean government-controlled cyber-espionage group. It said the group gathered intelligence in support of Pyongyang’s strategic objectives.  (With inputs from Reuters)