Kimsuky hackers are now using AI tools to enhance cyber attacks on crypto firms, according to cybersecurity experts.
The North Korean hacking group Kimsuky has started leveraging local artificial intelligence systems to target cryptocurrency and financial institutions, according to cybersecurity experts from Genians in South Korea.
Genians' research indicates that Kimsuky has adopted local large language models (LLMs) utilizing platforms like Ollama, GPT4All, and Msty. These tools function offline and utilize a method called Retrieval-Augmented Generation, enabling queries without sending data to cloud services.
Furthermore, analysts uncovered a range of libraries and frameworks within Kimsuky’s operations that are designed for embedding language models into their software, including an AI programming assistant named Cursor and various speech recognition tools.
Genians noted that Kimsuky is transitioning from merely experimenting with AI to actively incorporating it into their attack methodologies, focusing on utilizing existing technologies rather than creating proprietary models.
The group is also employing generative AI to produce phishing documents that pertain to digital assets, investment strategies, and fintech services. Some of these documents have been crafted to resemble those from a Korean AI investment platform, showcasing professional formatting and natural language.
In a related development, the cryptocurrency exchange Bybit filed a civil lawsuit in August against North Korea and the Lazarus Group, highlighting the ongoing concerns regarding cyber threats in the crypto sector.
