North Korea’s hackers using AI for attacks, cybersecurity firm says

A South Korean cybersecurity firm has revealed that North Korea's state-sponsored hacking group, Kimsuky, has begun employing artificial intelligence to enhance its cyberattack capabilities. According to a report released by Genians, a Seoul-based security company, Kimsuky has been using AI-generated documents in a systematic pattern of spear-phishing attacks targeting sectors including the military, diplomatic community, and academic institutions since 2026. These attacks involve the automated creation of malicious files designed to mimic legitimate documents such as research papers and official invitations. Genians noted that Kimsuky has leveraged open-source tools like Ollama, GPT-4All, and Msty to operate large language models offline, reducing the risk of detection. This approach allows the group to produce highly polished documents on diverse subjects quickly, significantly improving the efficiency of their social engineering tactics. The firm emphasized that this marks a notable evolution in cyber threats, moving beyond mere document forgery to enabling the large-scale automation of deceptive operations. Kimsuky and other North Korean-linked hacking groups have long been associated with a series of cyberattacks aimed primarily at securing financial benefits. In the first nine months of 2025 alone, North Korean hackers were estimated to have stolen over $2 billion in cryptocurrency, according to a report by the British blockchain analytics firm Elliptic. One of the most infamous incidents occurred in 2014 when North Korea was implicated in the hacking of Sony Pictures, a move that prompted severe backlash from Pyongyang due to the film The Interview, which depicted North Korean leader Kim Jong Un in a mocking light. Experts suggest that the integration of AI into cyber warfare is not unexpected given North Korea's established track record of cyber aggression. Jenny Town, a senior fellow at the Stimson Center in Washington, DC, stated that the development aligns with the broader trend of threat actors leveraging advanced technologies to amplify their impact. She noted that North Korea's hackers and programmers possess the capability to effectively utilize and exploit various AI tools to further their objectives. The cybersecurity landscape is evolving rapidly as advancements in AI raise concerns regarding the potential misuse by malicious entities. Recently, U.S. researchers announced the successful creation of synthetic viruses using AI, sparking both optimism about possible medical breakthroughs and apprehensions about the risks involved. Mark T. Hofmann, a specialist in cybercrime analysis, highlighted that AI has fundamentally transformed the nature of cybercrime by reducing the technical barriers for conducting harmful activities. He warned that the increasing reliance on generative AI and autonomous AI agents could lead to a surge in accelerated cyberattacks globally. As the use of AI becomes more prevalent, the challenge posed by AI-assisted cyberattacks is expected to grow substantially. Experts caution that these developments represent one of the primary challenges of the current decade, emphasizing the urgent need for robust defensive strategies and international cooperation to mitigate the risks associated with this emerging threat.