North Korea-linked cyber-espionage group Kimsuky is developing local artificial intelligence infrastructure that could make its longstanding attacks on the cryptocurrency industry cheaper and more scalable, according to new research from South Korean cybersecurity firm Genian Security Center.

The findings, detailed in a report by Genians, point to a significant shift: rather than simply using AI to generate phishing messages, the group appears to be integrating AI tools directly into its attack infrastructure.

AI Tools and Infrastructure Identified

Genian Security Center researchers identified local deployments of several AI tools on infrastructure linked to Kimsuky, including Ollama, GPT4All, and Msty, as well as retrieval-augmented generation (RAG) technology. All three are open-source tools designed to run large language models on consumer hardware without sending data to external servers—a setup that would allow attackers to process sensitive data internally, a capability potentially useful for handling stolen emails, internal documents, or other information obtained during an intrusion.

The researchers also detected AI-agent frameworks, speech-to-text software, and Cursor, an AI-assisted coding tool, on the group's infrastructure. According to Genians, this configuration could support a range of activities including malware development, data analysis, and attack automation.

Additionally, the firm reported discovering finance- and cryptocurrency-themed documents that appeared to have been generated or refined with AI assistance. These documents were designed to mimic legitimate investment reports and workplace materials.

The findings suggest that Kimsuky may be transitioning from using generative AI primarily for crafting individual phishing lures toward incorporating AI capabilities into a broader operational workflow that could include malware development, stolen data analysis, and partial automation of cyber operations.

Genians noted that the findings have not been independently verified.

A Persistent Threat to the Crypto Sector

Kimsuky, active since at least 2012 and also tracked under names such as Thallium and Velvet Chollima, is a North Korean-linked cyber-espionage group with a track record of targeting government agencies, diplomatic institutions, military organizations, and other entities, including individuals and organizations connected to the cryptocurrency sector. The group is part of a broader North Korean cyber apparatus that, according to United Nations Panel of Experts reports, has been linked to revenue-generation efforts in support of the country's weapons programs. Genians has also documented the group's use of GitHub- and GitLab-based infrastructure in its operations.

The cybersecurity firm recommends that organizations shift toward behavior-based detection rather than relying solely on identifying suspicious or AI-generated text.

Implications for Crypto Companies

Cryptocurrency companies depend on employees, developers, executives, and transaction signers who may hold access to sensitive accounts, critical infrastructure, or digital assets. AI-generated phishing and social-engineering content could make targeted attacks more difficult to detect, particularly as local AI deployments remove the telemetry that external API calls would otherwise generate.

The incorporation of local AI capabilities by a North Korean-linked threat actor underscores a broader trend in cybersecurity: AI is increasingly becoming embedded in attackers' operational infrastructure rather than serving merely as a tool for generating deceptive emails. For the cryptocurrency sector—where North Korean actors have been attributed to some of the largest digital asset thefts on record—this development adds another dimension to a threat landscape that already includes supply-chain compromises, fake job recruitments, and malicious code contributions disguised as open-source collaboration.

For crypto companies, this reinforces the importance of robust access controls, hardware-based authentication, multi-party transaction approvals, and continuous behavioral monitoring to mitigate evolving threats.