Artificial Intelligence

Report: North Korean Hackers Harness AI for Cyberattacks

Is AI supercharging North Korea's cyberattacks or can safety controls neutralize this overhyped tool?

Published AUG 10

Report: North Korean Hackers Harness AI for Cyberattacks

Story

Above: The ChatGPT logo arranged on a smartphone in Forest Hills, New York, on March 27. Image credit: Gabby Jones/Bloomberg/Getty Images

The Facts

South Korean cybersecurity firm Genians reported on Monday that the North Korean-linked hacking group Kimsuky had set up local large language model environments on its attack infrastructure using tools including Ollama, GPT4All and Msty.
Reuters
The Chosun Daily
Genians assessed that Kimsuky is in the process of accumulating the technology and capabilities to integrate AI into its overall attack operations, rather than training its own models from scratch.
Genians
The Chosun Daily
Kimsuky's infrastructure showed evidence of retrieval-augmented generation (RAG) configuration, which enables an AI system to generate responses based on specific documents provided by the user, such as internal or stolen materials.
Genians
Reuters
Kaspersky reported in May that Kimsuky had used a large language model to help build a malware strain called HelloDoor, adding that the code contained emoji-laden comments and grammatical patterns consistent with AI-generated text.
Japan Wire by Kyodo News
Crypto Briefing
Genians also identified finance and cryptocurrency-themed decoy documents in the campaign that appeared to have been generated with AI, designed to resemble legitimate investment reports and workplace documents to increase user trust.
Reuters
The Chosun Daily
This comes as security researcher Vangelis Stykas, CTO of cybersecurity firm Kumio, said at the Black Hat conference in Las Vegas that North Korean hacking operations had impacted 1,640 companies across 57 countries, adding that 700 to 800 suffered severe compromises, including root access to servers and AWS accounts.
Wired
Cryptopolitan

Sources Split

LEFT

CENTER

RIGHT

ESTAB
CRIT

CENTER

PRO
ESTAB

The Spin

Narrative A

North Korea's hackers have weaponized AI to supercharge attacks on a global scale, with devastating breaches. Fake job offers tricked developers into downloading malware, handing North Korean operatives root access to servers, crypto wallets and sensitive databases. AI tools are now automating these attacks and crafting sharper phishing lures — making an already catastrophic threat even harder to stop.

Mario Nawfal on X

Owen Gregorian on X

Narrative B

AI is not the super-weapon for hackers that the hype suggests — state-backed threat actors using Gemini showed no signs of developing novel attack capabilities. These groups rely on AI for basic tasks like research and content drafting, and every attempt to use it for malicious purposes was blocked by safety controls. Generative AI speeds things up for bad actors but doesn't fundamentally change what they can pull off.

Google Cloud