Back Mezha

Kimsuky Develops AI Tools to Automate Cyberattacks, Researchers Say

Mezha • August 10, 2026

The group’s latest activity suggests a shift from isolated experiments toward a broader system for turning stolen information into operational advantages.

North Korean hacking group Kimsuky is developing tools based on large language models and collecting software that could help automate cyberattacks, analyze stolen materials, and create more convincing phishing campaigns, a South Korean cybersecurity company reported.

Genians, a South Korean cybersecurity company, found indications that the country-linked Kimsuky group had deployed and was operating local AI models, using Ollama, GPT4All, and Msty tools together with a document retrieval system based on retrieval-augmented generation (RAG) technology.

According to specialists, these tools allow documents to be processed without transmitting sensitive data to external AI services.

The infrastructure linked to the campaign also contained frameworks for developing AI agents, speech recognition software, and Cursor – an AI-powered tool designed to assist with coding tasks, the company said.

Genians’ findings indicate that Kimsuky is not limiting its use of generative AI to creating phishing lures, but is developing ways to integrate existing AI models into malware development, data analysis, and attack automation.

Documents related to finance and cryptocurrency were also found. According to the company, they may have been created with the help of artificial intelligence and designed to look like legitimate investment reports and other business materials.

The information obtained by the researchers has not been independently verified.

According to the United States and South Korea, as well as cybersecurity experts, North Korea has used state- cyber units for intelligence gathering, theft, and revenue generation for many years, as confirmed by official statements from both countries and by specialists.

In 2023, the U.S. Treasury Department imposed sanctions on the Kimsuky group, describing it as part of a government cyberintelligence unit and documenting activity aimed at supporting North Korea’s strategic objectives.

Finally, experts point to the growing role of artificial intelligence in cyber threats and emphasize the need for stronger security measures and monitoring to prevent similar attacks in the future.

Don’t miss other news:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kimsuky Expands AI Capabilities for Cyberattacks The North Korean hacking group Kimsuky has developed local AI tools to enhance its cyberattack capabilities, as reported by Genians Security Center on August 10, 2026. The group is utilizing large language models (LLMs) such as Ollama and GPT4All, alongside retrieval-augmented generation (RAG) technology, to automate phishing campaigns and analyze stolen data without sending sensitive information to external services. Recent findings indicate that Kimsuky is creating sophisticated phishing lures that mimic legitimate financial documents, making them harder to detect. This marks a shift from previous tactics that primarily relied on reusing stolen documents. The group has been targeting sectors related to finance and cryptocurrency, utilizing AI-generated materials to enhance the effectiveness of its attacks. The U.S. Treasury had previously sanctioned Kimsuky in 2023 for its cyber-espionage activities supporting North Korea's strategic goals. 49 sources 78

Extracted Entities

Kimsuky Develops AI Tools to Automate Cyberattacks, Researchers Say

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (1)

Countries (2)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)