North Korea’s hackers have spent years targeting the cryptocurrency industry. Now, cybersecurity researchers say one of its hacking groups, Kimsuky, is building local AI infrastructure that could make those attacks cheaper and easier to scale.
The findings, reported by South Korean cybersecurity firm Genian Security Center, point to a broader shift from using AI to write phishing messages toward integrating AI into attack infrastructure.
AI Tools and Infrastructure Found
According to Genians, researchers identified local deployments of AI tools including Ollama, GPT4All and Msty, as well as retrieval-augmented generation (RAG) technology.
Sponsored
Running AI systems locally could allow attackers to process sensitive information without sending it to an external AI provider. That may be relevant when handling stolen emails, internal documents or other data obtained during an intrusion.
Genians also identified AI-agent frameworks, speech-to-text software and Cursor, an AI-assisted coding tool, on infrastructure linked to Kimsuky. The cybersecurity firm said the setup could support activities including malware development, data analysis and attack automation.
The firm also reported finding finance- and cryptocurrency-themed documents that appeared to have been generated or assisted by AI. The documents were designed to resemble legitimate investment reports and workplace materials, according to Genians.
The findings suggest that Kimsuky may be moving beyond using generative AI primarily for creating individual phishing lures and toward incorporating AI tools into a broader operational workflow. Genians said this could include malware development, analysis of stolen data and automation of parts of cyber operations.
The findings have not been independently verified.
A Long-Running Threat Actor
Kimsuky is a North Korean-linked cyber-espionage group that has targeted government, diplomatic, military and other organizations, including individuals and organizations connected to the cryptocurrency sector.
Genians has also tracked the group’s use of GitHub- and GitLab-based infrastructure in its operations.
The cybersecurity firm recommends that organizations place greater emphasis on behavior-based detection rather than relying solely on identifying suspicious or AI-generated text.
Why This Matters for Crypto
Crypto companies rely on employees, developers, executives and transaction signers who can have access to sensitive accounts, infrastructure or digital assets.
AI-generated phishing and social-engineering content could make targeted attacks harder to spot.
North Korean-linked threat actor incorporating local AI capabilities into its cyber operations points to a broader shift in cybersecurity: AI is increasingly becoming part of attackers’ operational infrastructure, rather than simply a tool for generating phishing emails.
For crypto companies, that reinforces the need for strong access controls, hardware-based authentication, transaction approvals and behavioral monitoring.
Delve into DailyCoin’s popular crypto news today:
Memecoin TUT Becomes Most-Liquidated Token After 1,100% Rally
XRP Liquidity Hunt’s On: Red Clusters Sub-$1 Dictate Next Move