North Korea's Kimsuky hacking group has developed and deployed large language model tools to automate cyberattacks, analyse stolen data and craft more convincing phishing campaigns, according to South Korean cybersecurity firm Genians.
The group has set up and operated open-source AI management tools including Ollama, GPT4All and Msty, combined with retrieval-augmented generation technology, allowing it to run models without an internet connection. Genians also discovered AI agent development frameworks, speech-to-text software and the AI-assisted coding tool Cursor within Kimsuky-linked infrastructure. The firm identified AI-generated decoy documents focused on finance and cryptocurrency, designed to mimic legitimate investment reports and workplace materials.
Kimsuky has used AI-generated documents in spear-phishing attacks since 2026, targeting military, diplomatic and academic entities. The U.S. Treasury sanctioned the group in 2023, designating it a North Korean government-controlled cyber espionage organisation.