A North Korean-linked hacking group known as Kimsuky has built tools to run large language models locally and collect software that can help automate cyberattacks. South Korean cybersecurity firm Genians reported the findings on Monday. Evidence shows the group set up systems using Ollama, GPT4All and Msty, along with retrieval-augmented generation for searching documents. These tools let operators process material without sending sensitive data to external AI services. Genians also found AI agent frameworks, speech-to-text software and the coding tool Cursor on linked infrastructure. The group appears to be moving past simple generative AI for phishing lures. It is preparing to integrate existing models into malware development, data analysis and attack automation. Finance and cryptocurrency-themed decoy documents that look AI-generated were also found. Kimsuky has been sanctioned by the US Treasury as a North Korean government-controlled cyber-espionage unit.
A North Korean-linked hacking group known as Kimsuky has built tools to run large language models locally and collect software that can help automate cyberattacks. South Korean cybersecurity firm Genians reported the findings on Monday. Evidence shows the group set up systems using Ollama, GPT4All and Msty, along with retrieval-augmented generation for searching documents. These tools let operators process material without sending sensitive data to external AI services. Genians also found AI agent frameworks, speech-to-text software and the coding tool Cursor on linked infrastructure. The group appears to be moving past simple generative AI for phishing lures. It is preparing to integrate existing models into malware development, data analysis and attack automation. Finance and cryptocurrency-themed decoy documents that look AI-generated were also found. Kimsuky has been sanctioned by the US Treasury as a North Korean government-controlled cyber-espionage unit.