- North Korean hacking group Kimsuky is reportedly using local AI systems to strengthen cyberattacks targeting crypto and financial companies.
- Researchers discovered three offline LLM environments that could help automate malware development, data analysis, coding, and phishing campaigns.
- The findings highlight a growing security threat as AI allows hackers to identify vulnerabilities and create more convincing attacks at greater speed.
North Korean hacking group Kimsuky is reportedly taking its cyber operations to another level, integrating artificial intelligence into attacks targeting cryptocurrency and financial companies.
South Korean cybersecurity firm Genians found evidence that Kimsuky built and operated three local large language model environments using Ollama, GPT4All, and Msty. Unlike cloud-based AI services, these systems can operate locally and offline, giving attackers the ability to work with sensitive information without sending their queries through external servers.
The setup also supports retrieval-augmented generation, allowing hackers to feed their own information into AI models and generate more targeted responses. That combination could make local AI particularly useful for analyzing stolen data, developing malicious software, and automating portions of sophisticated cyberattacks.
Kimsuky Builds AI Into Its Hacking Toolkit
Genians discovered that the group has collected software libraries and frameworks designed to integrate language models directly into custom applications.
Kimsuky’s toolkit reportedly includes the AI coding assistant Cursor alongside speech-to-text technology and other tools capable of supporting automated workflows. Researchers believe the activity is primarily focused on combining existing open-source AI models with malware development, data analysis, and attack automation.
Rather than developing entirely new artificial intelligence models, Kimsuky appears to be taking readily available AI technology and adapting it for cyber operations. Genians said the activity shows the group is moving beyond simple experimentation and preparing AI for continued use in real-world attacks.
Crypto Phishing Attacks Become More Convincing
Cryptocurrency companies remain an important target. Researchers discovered evidence that Kimsuky is using generative AI to produce polished phishing documents centered around digital assets, fintech products, and investment strategies.
Some of the documents reportedly mimicked materials from a Korean AI-powered investment platform, using natural language, professional layouts, and convincing design elements to appear legitimate.
That creates a particularly difficult problem for crypto companies and their employees. Traditional phishing attempts often contain obvious spelling mistakes or awkward formatting, but AI can produce significantly cleaner material, making fraudulent emails and documents harder to distinguish from genuine corporate communications.
North Korean Crypto Theft Reaches Billions
North Korean-linked hackers have already demonstrated their ability to steal enormous amounts of cryptocurrency.
According to Chainalysis, North Korean attackers stole approximately $2.02 billion in crypto last year, with the figure including the massive $1.5 billion Bybit exchange hack.
Their techniques range from relatively straightforward phishing campaigns to far more elaborate operations involving IT workers gaining positions inside cryptocurrency companies. Once inside, attackers can potentially access sensitive systems, credentials, private information, and internal infrastructure.
Adding AI to these methods could make attacks faster and considerably more scalable.
AI Is Changing the Cybersecurity Battle
The threat extends beyond North Korean hacking groups. As artificial intelligence becomes more capable at understanding and generating software code, security researchers have warned that attackers can use the technology to discover vulnerabilities faster than traditional review processes can identify and patch them.
NEAR Protocol co-founder Illia Polosukhin has warned that AI is already accelerating hackers’ ability to identify weaknesses in software systems, creating a growing challenge for cybersecurity teams.
Recent crypto exploits have intensified those concerns. The roughly $100 million Coldcard Bitcoin hardware wallet exploit, for example, has been linked to suspicions that AI helped uncover an obscure vulnerability that had previously gone unnoticed.
Kimsuky’s adoption of local AI infrastructure shows how quickly the cybersecurity landscape is changing. AI is no longer simply helping attackers write convincing phishing emails, it’s increasingly becoming part of the broader hacking toolkit. For crypto companies holding billions of dollars in digital assets, that evolution could make stronger internal security, employee training, and continuous vulnerability testing more important than ever.
