North Korean hacking group Kimsuky develops AI tools to automate cyberattacks, South Korean firm reports

Aug 10, 2026

South Korean cybersecurity firm Genians reports that the North Korean state-backed hacking group Kimsuky is developing local large language model tools and collecting software to automate cyberattacks. Kimsuky has deployed offline tools like Ollama, GPT4All, and Msty to process stolen data securely, alongside OpenAI Whisper archives to transcribe intercepted audio. The group also uses AI-generated decoy documents to target diplomatic, military, and financial entities globally.

Kimsuky AI tool development

▪The South Korean cybersecurity firm Genians reported on August 10, 2026, that the North Korean hacking group Kimsuky has built local large language model tools and collected software to automate cyberattacks.
▪Genians identified AI agent development frameworks, .NET and C# AI-development packages, and the AI-assisted coding tool Cursor on infrastructure linked to Kimsuky's campaign.
▪Genians reported that Kimsuky is transitioning from using generative AI solely for phishing lures to integrating existing AI models into malware development, data analysis, and attack automation.

Local LLM deployment

▪Genians discovered that Kimsuky set up tools to run and manage AI models locally, including Ollama, GPT4All, and Msty, to process documents without sending sensitive information to outside AI services.
▪Genians found a GPT4All database named localdocs_v3.db on Kimsuky's infrastructure, indicating the configuration of a retrieval-augmented generation environment to search and query stolen document collections.

Speech-to-text transcription capabilities

▪Genians discovered OpenAI Whisper-related archives, including faster-whisper.7z and whisper.7z, alongside Korean-language training materials on Kimsuky's infrastructure for extracting text from audio files.
▪Genians assessed that Kimsuky is in a research and capability-acquisition phase for speech-to-text tools, with no evidence that the transcription tooling has been operationally deployed against victims.

AI-generated phishing documents

▪Genians reported that Kimsuky has used AI-generated, highly polished finance and cryptocurrency-themed decoy documents designed to resemble legitimate investment reports in its spear-phishing campaigns since 2026.
▪Kimsuky's Operation GitPower targets foreign diplomatic missions, military and security organizations, policy and academic communities, and virtual-asset-related entities using malicious LNK files disguised as legitimate correspondence.

North Korean cyber espionage

▪The U.S. Treasury sanctioned Kimsuky in 2023 as a North Korean government-controlled cyber-espionage group that gathers intelligence to support Pyongyang's strategic objectives.
▪According to British blockchain analytics firm Elliptic, North Korean hackers stole more than $2 billion worth of cryptocurrency during the first nine months of 2025.