North Korean hackers are deploying local AI systems in attacks on the crypto industry.
An analysis of new threats shows that the North Korean group Kimsuky, operating in the interests of Pyongyang, has shifted to actively using local large language models (LLMs) for cyberattacks on cryptocurrency and financial structures. This is the conclusion reached by cybersecurity experts from Genians during an in-depth investigation of the attackers' infrastructure.
Offline AI as a New Attack Tool
During the technical analysis, it was discovered that Kimsuky operators deployed local LLM environments based on the open-source platforms Ollama, GPT4All, and Msty. The key feature of these solutions is full autonomy: they operate without connecting to cloud services, which ensures stealth and eliminates data leaks through external channels. The use of the Retrieval-Augmented Generation (RAG) method allows hackers to process queries and retrieve information directly from local databases, minimizing digital footprints.
Additionally, the group's arsenal includes libraries and frameworks for integrating language models into their own malware, as well as development tools, including the AI assistant Cursor and speech recognition systems. This points to a systematic approach: open-source LLMs are embedded not only in phishing campaigns but also in the automation of complex attack chains.
From Experiments to Combat Deployment
In my assessment, Kimsuky has already moved beyond testing AI technologies. This is about the practical integration of ready-made models into real operations, with priority given to using existing developments rather than building proprietary algorithms from scratch. This significantly lowers the entry barrier and accelerates the development cycle of new threats.
Generative AI in phishing schemes deserves special attention. The group creates high-quality documents imitating materials on digital assets, investment strategies, and fintech services. Some samples were styled to resemble documentation from a Korean AI investment platform—with natural language and professional formatting, making them extremely convincing to victims.
It is worth recalling that in August, the cryptocurrency exchange Bybit filed a civil lawsuit against North Korea and the Lazarus Group, highlighting the growing legal and operational response to North Korean hackers' activities. In the current context, the use of local AI represents a new stage in the evolution of cyber threats, requiring crypto companies to rethink their defensive strategies.