A North Korean-linked hacking group has developed and collected artificial intelligence tools that could help it automate cyberattacks, analyse stolen data and create more convincing phishing campaigns, according to South Korean cybersecurity firm Genians. The findings indicate that the group is expanding its use of AI beyond simple content generation and is exploring ways to use the technology across different stages of cyber operations.

North Korea has used state-linked cyber units for years to conduct espionage, steal money and generate revenue. Genians said it found evidence that the group Kimsuky had established tools to run and manage AI models locally. These included Ollama, GPT4All and Msty. The group also used retrieval augmented generation, or RAG, a technology that allows AI systems to search and work with large amounts of stored information.

The use of local AI tools could allow Kimsuky operators to work with sensitive documents without sending the information to external AI services. This could help the group analyse stolen material while keeping the data within its own systems. It also suggests that the hackers are looking at ways to use AI while limiting their exposure to outside platforms.

Genians also identified several other AI-related tools on infrastructure linked to the campaign. These included frameworks to develop AI agents, speech-to-text software and Cursor, an AI-assisted coding tool. The presence of these tools indicates that Kimsuky may be developing a wider AI-based workflow for its cyber activities.

According to Genians, the findings show that Kimsuky is moving beyond the use of generative AI to create phishing lures. The group appears to be building the ability to connect existing AI models with malware development, data analysis and the automation of attacks. This could allow its operators to complete certain tasks faster and process larger amounts of information during cyber operations.

The cybersecurity firm also found finance and cryptocurrency-themed documents that appeared to have been created using AI. Genians said the documents were designed to look like legitimate investment reports and other workplace materials. Such documents could be used as decoys or as part of attempts to gain the trust of potential targets.

Hackers have increasingly used generative AI to make phishing messages and other deceptive material more convincing. The latest findings suggest that some groups are now exploring more advanced AI tools for analysing information, developing malicious software and automating parts of an attack.

Genians said its findings point to a shift in how Kimsuky approaches AI. Instead of using AI only as a tool to improve individual tasks, the group appears to be developing the infrastructure needed to integrate AI into its broader cyber operations. Local language models, AI development frameworks and coding tools could give its operators more flexibility while handling sensitive information internally.

The findings, however, could not be independently verified. Genians did not provide evidence to confirm how extensively Kimsuky has used these tools in actual attacks. The discovery of the tools on infrastructure linked to the campaign nevertheless points to an effort to build greater AI capabilities within the group.

Kimsuky has long been linked to North Korean cyber activity. The group has carried out espionage campaigns and has been accused of targeting organisations and individuals to obtain sensitive information. North Korean cyber units have also been linked to financial theft and other operations aimed at generating revenue for the country.

US and South Korean authorities, along with cybersecurity experts, have repeatedly linked North Korea to state-backed cyber operations. In 2023, the US Treasury sanctioned Kimsuky and described it as a North Korean government-controlled cyber-espionage group. The Treasury said the group gathered intelligence to support Pyongyang’s strategic objectives.

The latest Genians report adds to concerns over how North Korean hacking groups could use AI to expand their capabilities. By combining AI models with tools for coding, document analysis and information processing, groups such as Kimsuky could potentially make cyber campaigns more efficient. The findings also show how attackers are exploring ways to use AI while keeping sensitive data away from external services.