A North Korean state-sponsored cyber-espionage group, Kimsuky, is reportedly integrating artificial intelligence (AI) into its attack operations, including malware development and data analysis. According to a South Korean security firm, Genians, Kimsuky has been observed setting up and operating local large language model (LLM) environments and collecting various AI-related technologies.
Genians' investigation, which spanned several months, revealed that Kimsuky is using tools such as Ollama, GPT4All, and Msty to run LLMs locally. This approach helps prevent conversation data from being transmitted to external AI services, thereby reducing the risk of exposure for the state-sponsored actor. The group also experimented with other AI tools like Cursor and utilized retrieval-augmented generation (RAG) for local document searches, which can aid in quickly identifying valuable information within large datasets.
The researchers identified that Kimsuky has been collecting numerous libraries, including LLaMaSharp and Microsoft.Extensions.AI, as well as packages like OpenAI and Azure.AI.OpenAI. These components suggest an intent to integrate commercial AI services into their custom applications. Evidence also indicated the use of speech-to-text tools, such as OpenAI's Whisper speech recognition models, and the application of Cursor AI for code editing.
Kimsuky, operating under North Korea's Reconnaissance General Bureau, has a history of using phishing and decoy documents in attacks targeting government agencies, think tanks, academia, and security research organizations. Recent phishing campaigns by the group have involved ZIP archives containing malicious LNK files, often disguised as materials related to international events, research reports, or meeting requests.
When a recipient opens the archive and executes the LNK file, an embedded PowerShell loader is triggered. These PowerShell scripts are designed to collect extensive system information, including operating system version and architecture, system configuration, PC type, operating system installation and boot history, and a list of running processes. This information is then used to assess the infected environment and plan subsequent attacks.
The decoy documents used in these campaigns demonstrate a high level of sophistication, employing natural language, polished structures, and formats similar to actual business materials to increase user trust and induce the execution of malicious files. In some instances, AI was reportedly used to craft lures related to virtual assets and finance. The attackers also employ various obfuscation techniques, such as Base64 encoding, string splitting, and custom decoding routines, to conceal the malicious behavior of their files.
For command-and-control (C2) infrastructure, Kimsuky continues to leverage Git repositories. Genians identified multiple public GitHub repositories operated by the threat actor, some containing configuration files, PowerShell scripts, and payloads for subsequent attacks. These Git-based infrastructures were also used for malware development and testing, stolen data management, and AI technology research.
While Genians did not find evidence that Kimsuky is training its own AI models, the findings strongly suggest a continuous effort to integrate AI into existing attack capabilities. This shift necessitates that defenders move away from content-based assessment, as AI can produce highly convincing decoys, and instead focus on behavior-based detection. Organizations are advised to look for anomalous behaviors following LNK execution, such as PowerShell execution, persistence establishment, and external communications, in addition to using indicators of compromise (IoCs).
