North Korean state-backed hackers are using artificial intelligence to bolster cyberattacks against targets in the military, diplomacy and academia, a report has found.
Kimsuky, a hacking group linked to North Korea’s intelligence services, has used AI-generated documents in a “pattern” of spear-phishing attacks since 2026, the South Korean cybersecurity firm Genians said in the report released on Monday.
The attacks have used AI to automate the creation of malicious files disguised as legitimate documents, such as research reports and invitations, Seoul-based Genians said.
To avoid detection, Kimsuky has used open-source tools such as Ollama, GPT-4All, and Msty to run large language models without an internet connection, according to the report.
“AI can generate highly polished documents on a wide range of topics within a short period of time, making it a highly efficient tool for threat actors,” Genians said.
“This change is noteworthy because it goes beyond a shift in how decoy documents are created and demonstrates that AI can enable the automation and large-scale production of social engineering attacks.”
Kimsuky and other North Korean state-linked groups have been blamed for numerous cyberattacks in recent years, many of them aimed at extracting financial gains.
North Korean hackers stole cryptocurrency worth more than $2bn in the first nine months of 2025, according to a report by British blockchain analytics firm Elliptic.
In 2014, North Korea was identified by US authorities as the culprit in the hacking of Sony Pictures, which drew Pyongyang’s ire by lampooning North Korean leader Kim Jong Un in the comedy film “The Interview”.
(Al Jazeera)