North Korea’s Kimsuky hacking group has established and tested local artificial intelligence (AI) tools as it researches ways to integrate the technology into malware development and attack techniques, South Korean cybersecurity firm Genians said Monday.
The group appears to have used generative AI to create decoy documents. Genians said Kimsuky is developing capabilities to incorporate existing AI models into its attack activities.
Inside Kimsuky’s Local AI Tools
Kimsuky is a threat group operating under North Korea’s Reconnaissance General Bureau. The US Treasury sanctioned it in 2023 as a state-controlled espionage unit.
Investigators found evidence that Kimsuky had installed and configured several tools for running AI models locally, including Ollama, GPT4All, and Msty.
Genians said local processing could reduce the risk of sensitive or stolen material being sent to external AI services. The researchers also identified retrieval-augmented generation, or RAG, which allows AI models to retrieve information from selected documents.
Genians also identified AI-agent frameworks, speech-to-text software, and Cursor, an AI-assisted coding tool, on related infrastructure. The company said the collection could support efforts to integrate AI into malware development, data analysis, and attack automation.
“Based on these findings, the threat actor associated with the state-sponsored hacking group Kimsuky is assessed to have continuously researched ways to actively incorporate AI technologies into actual threat activities, including malware development and the advancement of attack techniques, rather than merely experimenting with them,” the report read.
Follow us on X to get the latest news as it happens
From Crypto Decoys to Automation
The group reportedly used financial and cryptocurrency decoy documents that appeared to be AI-generated. The files mimicked investment reports.
Other North Korea-linked operations have paired AI with crypto-focused attacks on executives and engineers. Such groups stole a reported $2.02 billion in crypto during 2025, according to one industry estimate on theft.
Genians identified two potential risks. RAG could help retrieve useful information from stolen documents, while speech-to-text tools could convert stolen audio into searchable text.
Nonetheless, Genians assessed that Kimsuky’s local AI efforts remained focused on research and acquiring knowledge about how the technology could support its operations. The researchers found no evidence that the group had trained its own AI models.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
Bitrue