North Korea-associated hacking group Kimsuky is deepening its use of artificial intelligence, according to new research from South Korean cybersecurity firm Genians. The findings indicate that the threat actor is constructing local AI environments and leveraging generative tools in campaigns aimed at cryptocurrency and financial-sector users.

Kimsuky, also tracked as APT43 and designated by the U.S. Treasury Department in 2023 for its role in cyber-enabled financial theft supporting North Korean state interests, has long targeted think tanks, academics, and financial professionals. The group's pivot toward self-hosted AI tooling marks an escalation in how sanctioned threat actors are adapting off-the-shelf technology for operational use.

Genians reported that the AI-driven activity is embedded within Kimsuky's broader attack operations rather than functioning as a standalone initiative. The researchers track the ongoing activity as Operation GitPower, which builds upon tactics previously tied to the FlowerPower campaign.

Local AI Infrastructure

Genians identified three tools used to operate Kimsuky's local large language model environments: Ollama, GPT4All, and Msty. All three are freely available, open-source frameworks designed to run large language models on consumer-grade hardware without requiring internet access or cloud subscriptions. The group was additionally observed exploring retrieval-augmented generation (RAG) technology and the AI coding assistant Cursor.

These findings suggest Kimsuky is moving beyond occasional use of public AI chatbots and is instead preparing to integrate AI across multiple stages of the attack lifecycle. By operating AI models locally, the attackers maintain greater control over their data and workflows while eliminating telemetry that cloud-based AI providers might share with law enforcement or security researchers. Sensitive queries, malware development, and collected intelligence can all be processed without relying on third-party cloud AI services.

Genians assessed that the evidence points to a capability-development phase in which AI could be applied to malware creation, information analysis, and attack automation. The development parallels broader industry concerns documented by Microsoft and OpenAI, which have both reported attempts by state-affiliated actors—including North Korean groups—to leverage large language models for reconnaissance, scripting, and social engineering.

AI-Generated Lures Replace Crude Phishing

A notable shift identified by researchers involves the quality of Kimsuky's phishing materials. Genians discovered content generation logs related to virtual assets, financial investment, and game development, all showing signs of AI-assisted creation. The resulting documents were professionally structured, written in natural language, and closely resembled legitimate business correspondence—a meaningful improvement over the grammatically inconsistent lures that have historically allowed defenders to flag North Korean phishing attempts.

Researchers found metadata linking certain English-language documents to python-docx or WPS Office. The creation and modification dates of these files exhibited unusually regular patterns, consistent with an automated document production pipeline.

In one observed campaign, a malicious LNK file was disguised as an investment strategy document. The lure was designed to mimic a Korean fintech platform, increasing the likelihood that targets would trust the delivery.

Sustained Targeting of Crypto and Financial Sectors

Kimsuky continues to direct attacks at organizations and professionals connected to virtual assets, finance, diplomacy, security, and international affairs. Blockchain analytics firms including Chainalysis have consistently ranked North Korea as one of the most prolific state-sponsored crypto thieves, with linked groups such as Lazarus and Kimsuky implicated in billions of dollars in stolen digital assets over recent years.

The technical delivery chain follows established patterns. Victims receive malicious LNK shortcut files packaged within ZIP archives. Upon execution, the files reveal hidden command-line instructions or deploy PowerShell loaders.

Genians advised defenders to monitor for anomalous LNK execution arguments, PowerShell commands concealed within files, unusual scheduled tasks, access to the GitHub Raw Contents API, irregular personal access tokens, and encrypted .data arguments.

Source: CryptoNinjas