North Korean hacker group Kimsuky weaponizes AI, launches more stealthy cyber attacks targeting the cryptocurrency sector

TechFlow news, August 11. According to Bitcoin.com, cybersecurity company Genians Security Center released an analysis report stating that the hacker organization Kimsuky, subordinate to the North Korean Reconnaissance General Bureau, is building and testing a suite of AI-centric cyberattack tools. Researchers found deployment traces of three local AI platforms—Ollama, GPT4All, and Msty—in its infrastructure, as well as AI development framework components such as Microsoft Semantic Kernel and LLaMaSharp, indicating that the organization is systematically developing dedicated AI attack tools rather than merely making temporary attempts.

Since early 2026, Kimsuky has used high-quality documents generated by generative AI for spear phishing attacks targeting the virtual assets, financial investment, and game development sectors. AI-generated professional documents have significantly reduced the effectiveness of traditional phishing email identification. The attack vector consists of ZIP archives disguised as legitimate documents, containing malicious LNK files that can silently execute PowerShell commands in the background upon triggering.