A high-tech North Korean hacking group has quietly developed its own AI tools tailored to specifically improving and automating its cyberattacks, reveals South Korea’s cybersecurity firm. This group, which is tracked as Kimsuky, is likely much more than just exploiting publicly available AI to conduct basic phishing attacks. Rather, they have built an entire ecosystem of big language model tools and systems, such as an AI development platform and document retrieval systems, which could revolutionize the magnitude and utility of their operations.
Cybersecurity firm Genians found evidence that the Kimsuky operators have been creating local environments to deploy and operate AI models on their own systems. One of the tools found was Ollama, GPT4All and Msty which enable independent deployment of AI models without external cloud services. This could indicate the group is focused on maintaining its operational security by steering clear of sharing critical information with external AI service providers that could be tracked or observed. It allows them to retain control over all of their operations, and might also help to prevent exposing their approaches to foreign intelligence services.
The key aspect of the development that is particularly worrying is the use of retrieval augmented generation technology, which the group has added to its toolbox. This document search technology helps AI systems to extract data from large documents and respond to the queries based on the given reference data. The consequences of this are grave for a hacking group such as Kimsuky. They might also be able to input internal documents, company records, or classified information, and ask the AI to provide them with actionable insights. Natural language questions about compromised information could be asked by analysts and answered in seconds with synthesized answers, greatly speeding the processing of stolen data.
The Genians report also noted that AI agent development frameworks, speech-to-text software, and an AI coding assistant known as Cursor were found in the campaign’s infrastructure. They suggest a community that is methodically developing its broad AI arsenal. The coding tools raise significant concerns, because they can be used to exploit AI agents to find vulnerabilities, create exploit code, and modify attacks based on defense strategies. It is not a capability that’s expected to be released in the future, but one being actively worked on and tracked by security vendors.
The history of Kimsuky conveys a reputation for intelligence gathering and espionage, particularly towards government agencies, think-tank institutions and research institutions. They have been known to conduct spear-phishing attacks to get logon credentials and sensitive data. The use of locally-owned AI models, however, indicates a shift in their approach. AI-generated content can create content that is highly targeted, grammatically correct, and contextually relevant at scale, as opposed to manually crafted phishing emails that are text-heavy and require human effort and have a risk of being detected. The technology allows them to tailor attacks with publicly available data on their targets, and keeps the façade of a well-behaved and nice-looking email message that avoids conventional spams.
Among the materials, Genians researchers found finance and cryptocurrency themed decoy documents, which seemed to have been created with the help of artificial intelligence. The documents were written in a manner that would be similar to real investment reports and standard office correspondence, just the kind of correspondence that would be sent in a financial institution or a tech firm. Analysing these files revealed the highly developed nature of the language and its structure, indicative of the use of generative AI. For instance, the documents included industry-specific jargon which would be hard for non-specialists to consistently generate without support. This sophistication makes the phishing attacks much more hazardous as it could be that even a careful employee could miss a telltale sign of fraud when the message looks as compelling and professional as an internal message.
It’s not as if the use of large language models by malicious actors is exclusive to the North Korean hackers; but Kimsuky’s efforts to create autonomous AI capabilities are unusual. There have been many state backed groups testing out generative AI for different applications, but localized tool suites appear to be a long term strategic investment. They can customize their AI infrastructure to suit their specific needs and requirements, which helps them avoid the limitations and restrictions imposed by commercial AI providers.This allows them to tailor their AI infrastructure to meet their unique needs and requirements, avoiding limitations and restrictions imposed by commercial AI providers. In addition, all the models are operating in their own environment, allowing them to be continually refined to fit their working context.
