Back En.Yna.Co.Kr

N.K. hacking group Kimsuky used AI coding agents to create decoys

En.Yna.Co.Kr • September 7, 2026

SEOUL, Sept. 7 (Yonhap) -- North Korea-linked hacking group Kimsuky was found to have leveraged artificial intelligence (AI) coding agents to create decoys for malicious codes, a local security firm said Monday.

Such findings were detected after an analysis of 13 malicious files collected last month, Genians Inc. said in its latest cybersecurity threat intelligence report.

According to the report, researchers found that the hacking group distributed emails attached with compressed files holding documents with titles such as "insurance bills," or "policy fund notice". They activated malware when users click them, the report said.

The files contained traces of being created by an open-sourced AI coding agent called opencode.

"In some of the PDF documents, both the 'creator' and 'producer' fields in the metadata were listed as 'opencode,'" the report said.

"These are not values typically generated with standard document creation software, strongly suggesting the documents were generated by an AI agent, through programming, rather than created manually."

Genians said it marks the first time that the company has detected signs of Kimsuky utilizing AI coding agents in its malicious attacks.

Earlier, the company said it detected signs of the hacking group using large language models (LLM) to create decoys and plan malicious attacks.

[email protected] (END)

7 military officers disciplined over lax management of firearms: data

Los Angeles declares 'BTS Week' ahead of concerts

N. Korea drops unification goal, cements Kim as sole leader in revised party charter

BLACKPINK's Lisa and Jisoo release solo singles on same day

(LEAD) Lee heads to France for state visit, summit with Macron

7 military officers disciplined over lax management of firearms: data

White House says U.S. policy on N. Korea unchanged, reaffirms Trump's openness to dialogue with Kim

(LEAD) Gov't proposes record 821 tln-won budget for 2027 to boost growth

BIFF to open with biggest lineup of 246 films since 2019

Samsung Electronics union leaders under probe over 'union blacklist'

Tourist complaints in S. Korea hit record high amid travel boom

(LEAD) Lee heads to France for state visit, summit with Macron

Lee arrives in France, set for summit with Macron in Paris

N. Korea commissions nuclear-capable naval destroyer Kang Kon

Seoul fireworks show attracts 1 million spectators

Waiting for fireworks festival

World island expo in Yeosu

Fireworks festival in Seoul

N.K. hacking group Kimsuky used AI coding agents to create decoys: report

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kimsuky Hacking Group Uses AI Coding Agent for Malware Decoys The North Korea-linked hacking group Kimsuky has been confirmed to use an open-source AI coding agent named 'opencode' to create decoy documents for malware distribution. A South Korean security firm, Genians, reported that analysis of 13 malicious files revealed that these documents were disguised as financial and insurance-related materials to lure users into activating malware. The metadata of the decoy files indicated they were generated by the AI agent, with both 'creator' and 'producer' fields showing 'opencode.' This marks the first confirmed use of an AI coding agent by Kimsuky, which had previously been known to utilize large language models for similar purposes. The attack method involved sending emails with compressed files containing these decoy documents, which, when clicked, activated the malware. The findings highlight a significant evolution in Kimsuky's tactics, indicating a shift towards automated attack preparation using AI technology. 6 sources 73

Extracted Entities

N.K. hacking group Kimsuky used AI coding agents to create decoys

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Domains (1)

Email Addresses (1)

MITRE ATT&CK (1)

Tools (1)