North Korea's Kimsuky hacking group has been installing and testing local AI tools for potential use in cyberattacks, according to a report from South Korean cybersecurity firm Genians on Monday. The group, which operates under the Reconnaissance General Bureau and was sanctioned by the US Treasury in 2023, appears to be moving beyond experimentation toward active integration of AI into its operations.
What Genians found
Investigators found evidence of installed AI tools including Ollama, GPT4All, and Msty on Kimsuky's infrastructure. They also identified retrieval-augmented generation (RAG) systems, AI-agent frameworks, speech-to-text software, and Cursor, an AI coding tool. Genians said the tools could support integrating AI into malware development, data analysis, and attack automation. The firm didn't say exactly when the tools were installed or how long they'd been in use. The report describes the setup as "related infrastructure," which suggests the tools are spread across the group's operational environment rather than sitting on a single machine.
Why local processing matters
Running AI locally reduces the risk of sending sensitive or stolen data to external AI services. That's a practical advantage for a group that handles large volumes of exfiltrated documents. Genians also flagged that RAG could retrieve useful information from stolen documents, and speech-to-text tools could convert stolen audio into searchable text. The local setup means the group can keep its operations under the radar while still getting the benefits of AI. It also means the tools are less likely to be detected by security products that monitor for outbound traffic to known AI providers.
Crypto decoys and the bigger picture
The group used financial and cryptocurrency decoy documents that appeared to be AI-generated, mimicking investment reports. That fits a broader pattern: other North Korea-linked operations have paired AI with crypto-focused attacks on executives and engineers. Such groups stole an estimated $2.02 billion in crypto during 2025, according to one industry estimate. The decoys are a reminder that AI isn't just a tool for code — it's also a way to make phishing lures more convincing. Kimsuky has a history of targeting crypto firms and individuals, and the AI-generated documents suggest the group is refining its social engineering playbook.
Genians assessed that Kimsuky is researching ways to actively incorporate AI into actual threat activities, not just experimenting. But the firm found no evidence that the group had trained its own AI models. That suggests the focus right now is on using off-the-shelf tools and adapting them to the group's needs. The report doesn't specify a timeline for when these tools might be deployed in a live attack, but the groundwork is clearly being laid. For defenders, the takeaway is that AI is no longer a future concern — it's already part of the threat landscape.
