North Korean hackers use AI to target crypto companies
North Korean hacker group Kimsuky is using local AI systems to target cryptocurrency and financial companies, according to a report published Monday by South Korean cybersecurity firm Genians.
According to the report, cybersecurity specialists found evidence that the hackers had deployed three local environments based on large language models — Ollama, GPT4All, and Msty.
These tools can operate offline and support retrieval-augmented generation, or RAG, allowing users to query their own datasets without sending information to external cloud services.
Kimsuky has also collected libraries and software tools for integrating language models into its own applications. The group has used the AI coding assistant Cursor as well as speech-to-text tools. According to Genians, the hackers are exploring ways to use existing open-source AI models for malware development, data analysis, and attack automation.
The company believes this is no longer a matter of isolated AI experiments, but rather systematic preparation to integrate the technology into real-world cyberattacks.
At the same time, Kimsuky does not appear to be developing its own AI models from scratch. Instead, the group is primarily focused on integrating existing solutions into its hacking tools.
Attacks on the crypto industry
Kimsuky also continues to use generative AI to create convincing phishing documents related to digital assets, investment strategies, and fintech services.
Some of the materials uncovered by researchers closely imitated documents from a Korean AI-powered investment platform. They featured natural language, professional formatting, and a consistent visual style typical of content created with generative AI tools.
Last year, North Korean hackers stole $2.02 billion worth of cryptocurrency. According to Chainalysis, this figure included the $1.5 billion hack of the Bybit exchange.
Their methods range from basic phishing emails to placing IT workers inside cryptocurrency companies in order to gain access to sensitive internal data.
The development of AI is making such attacks increasingly sophisticated. NEAR Protocol co-founder Illia Polosukhin previously said that AI significantly accelerates vulnerability discovery, allowing hackers to identify weaknesses in software faster than traditional security teams can fix them.
Part of the state apparatus
In North Korea, hacker groups have effectively become part of the state system. Their operations have long gone beyond ordinary cybercrime: DPRK-linked groups engage in espionage and the theft of money and cryptocurrency, while the proceeds are used to fund state programs. U.S. authorities and other members of international sanctions monitoring groups have directly linked such cyber operations to revenue generation for North Korea’s weapons of mass destruction and ballistic missile programs.
Cryptocurrencies have become particularly attractive targets because stolen assets can be moved across borders quickly while making their movement more difficult to trace. Analysts note that such thefts help Pyongyang generate foreign currency revenue and circumvent international sanctions that restrict its access to the global financial system.
As a reminder, Chainalysis is helping South Korea combat North Korean hackers.
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
