North Korean hackers developing AI tools for cyberattacks
What's the story
A South Korean cybersecurity firm, Genians, has reported that a North Korean hacking group is developing artificial intelligence (AI) tools to facilitate cyberattacks. The group, known as Kimsuky, has been discovered building large language model (LLM) tools and gathering software for automating cyberattacks. These developments could be used to analyze stolen data and create more convincing phishing campaigns.
Tech development
Kimsuky has developed tools to run and manage AI models
Genians has discovered that Kimsuky has developed tools for running and managing AI models locally. These include Ollama, GPT4All, and Msty.
The group has also developed retrieval-augmented generation (RAG), a document search technology.
These advancements would let them process documents without having to share sensitive data with outside AI services.
Capability expansion
The group is also creating AI tools for malware development
Along with the above-mentioned tools, Genians also found AI agent development frameworks, speech-to-text software, and Cursor, an AI-assisted coding tool.
These discoveries indicate that Kimsuky is not just using generative AI for phishing lures but is also building its capacity to integrate existing AI models into malware development.
This could be used for data analysis and attack automation.
Deceptive tactics
Kimsuky's decoy documents looked like they were generated using AI
Genians also discovered finance and cryptocurrency-themed decoy documents that looked like they were generated with AI.
These materials were designed to look like real investment reports and other workplace documents.
The findings point toward a sophisticated level of deception in Kimsuky's cyberattack strategies, further highlighting the potential threat posed by this North Korean hacking group.
Past activities
US sanctioned Kimsuky in 2023
For years, North Korea has employed state-linked cyber units for espionage, financial theft, and revenue generation.
The US Treasury Department had sanctioned Kimsuky in 2023 as a North Korean government-controlled cyber-espionage group.
The department said Kimsuky gathered intelligence in support of Pyongyang's strategic objectives.
This history of malicious activity makes the recent AI tool development all the more concerning.