South Korean cybersecurity firm Genians reports that the North Korean hacking group Kimsuky is building local artificial intelligence environments using open-source tools like Ollama and GPT4All. The group uses these offline systems to automate cyberattacks, develop malware, and generate highly convincing phishing documents targeting cryptocurrency and financial firms. This technological advancement comes as North Korean hackers stole an estimated $2.02 billion in cryptocurrency during 2025, including a $1.5 billion exploit of the Bybit exchange.
Kimsuky local AI infrastructure
- ▪South Korean cybersecurity firm Genians identified artificial intelligence agent frameworks, speech-to-text software, and the coding tool Cursor on infrastructure linked to the North Korean hacking group Kimsuky.
- ▪The local artificial intelligence environments built by the North Korean hacking group Kimsuky allow offline operation and support retrieval-augmented generation, preventing sensitive data from being sent to external cloud services.
- ▪South Korean cybersecurity firm Genians reported on August 10, 2026, that the North Korean hacking group Kimsuky built and tested local artificial intelligence environments using Ollama, GPT4All, and Msty.
AI-generated phishing campaigns
- ▪The North Korean hacking group Kimsuky used generative artificial intelligence to create polished decoy documents themed around digital assets and investment strategies to mimic legitimate investment reports.
- ▪Some of the phishing documents generated by the North Korean hacking group Kimsuky closely imitated materials from a South Korean artificial intelligence-powered investment platform, featuring natural language and professional formatting.
North Korean crypto theft scale
- ▪A February 2025 cyberattack on the Bybit cryptocurrency exchange, attributed to North Korea, resulted in the theft of $1.5 billion in Ether and staked Ether.
- ▪North Korea-linked hacking groups stole an estimated $2.02 billion in cryptocurrency during 2025, according to Chainalysis data.
- ▪On August 8, 2026, cryptocurrency exchange Bybit filed a lawsuit against the Democratic People's Republic of Korea, its Reconnaissance General Bureau, and the Lazarus Group in U.S. federal court.
Attack automation capabilities
- ▪A July 2026 exploit of Coldcard Bitcoin hardware wallets that resulted in a $100 million loss is suspected to have stemmed from an obscure vulnerability uncovered using artificial intelligence.
- ▪NEAR Protocol co-founder Illia Polosukhin stated that artificial intelligence is accelerating hackers' ability to identify software vulnerabilities faster than traditional security processes can patch them.
- ▪South Korean cybersecurity firm Genians assessed that the North Korean hacking group Kimsuky's artificial intelligence efforts focus on integrating existing open-source models to automate attacks, rather than training proprietary models.
Malware development tools
- ▪South Korean cybersecurity firm Genians reported that the North Korean hacking group Kimsuky is researching and preparing to integrate local artificial intelligence systems to support malware development.
- ▪The U.S. Treasury Department sanctioned the North Korean hacking group Kimsuky in 2023, identifying it as a state-controlled cyber-espionage unit operating under the Reconnaissance General Bureau.
Story comments
Loading comments…