Who is the Kimsuky group?

Kimsuky is a North Korean hacking group that was sanctioned by the U.S. Treasury Department in 2023 and designated as a cyber espionage organization under the control of the Pyongyang government.

What AI tools does Kimsuky use?

According to Genians' report, Kimsuky has installed AI model management tools like Ollama, GPT4All, and Msty, as well as the programming tool Cursor and speech-to-text software.

What do North Korean hackers use artificial intelligence for?

In addition to creating more convincing phishing campaigns, they are increasingly using AI for malware development, analyzing stolen data, and automating cyberattacks.

How does Genians know the documents are fake?

Genians discovered fake financial and cryptocurrency documents designed to look like legitimate investment reports, which appear to have been generated with the help of artificial intelligence.

World

Kimsuky Arms AI: North Korean Hackers Build a Digital Arsenal

A.C. · Prije 2h | 2 min

South Korean security firm Genians details in a new report how the notorious Kimsuky group uses tools like Ollama and Cursor to automate espionage and develop malware.

Summary

North Korean hacking group Kimsuky has developed AI tools to automate attacks and analyze data.
They use local tools like Ollama and GPT4All to avoid sending data to external services.
Beyond phishing, they are now integrating AI into malware development and creating fake financial documents.
The group is under Pyongyang's control and has been under U.S. sanctions since 2023 for cyber espionage.

The North Korean hacking group Kimsuky has built tools based on large language models and collected software to automate cyberattacks, analyze stolen material, and create more sophisticated phishing campaigns, South Korean cybersecurity firm Genians reported on Monday, August 10, 2026.

According to findings reported by Reuters and The Japan Times, Kimsuky has installed a range of tools for locally running and managing AI models, including Ollama, GPT4All, and Msty. This approach allows operators to process documents without sending sensitive information to external AI services, thereby protecting the nature of their activities.

Phishing Is Just the Beginning: AI Enters Malware Development

The infrastructure that Genians linked to this campaign also revealed tools for developing AI agents, speech-to-text software, and Cursor, an AI-assisted programming tool. These findings suggest that Kimsuky is going beyond merely using generative AI to craft phishing messages.

The report states that the group is now building capabilities to integrate existing AI models into the malware development process, data analysis, and full attack automation. The company also found fake documents related to finance and cryptocurrency that appear to be AI-generated, designed to look like authentic investment reports and business documents.

Under Pyongyang's Control: Espionage in Service of the State

U.S. and South Korean authorities, as well as cybersecurity experts, have warned for years that North Korea uses state-sponsored cyber units for espionage, financial theft, and revenue generation. The U.S. Treasury Department sanctioned Kimsuky in 2023, designating it as a cyber espionage organization under the direct control of the Pyongyang government.

At the time, the Treasury Department clarified that the group collects intelligence to support North Korea's strategic objectives. The latest report from Genians shows that the regime continues to invest in increasingly sophisticated cyber tools, integrating cutting-edge AI technologies into its offensive digital arsenal.