North Korean hackers wield AI to scale phishing and malware against South Korea

North Korean hacking groups are using artificial intelligence (AI) to mass-produce phishing documents targeting Korean users in a short time, and are also employing AI coding tools to develop malware and automate attacks. Analysts say AI is being used as a new weapon that boosts the attack productivity of hacking groups.

According to a report released on the 29th (local time) by Microsoft (MS) Threat Intelligence on the 30th, North Korean hacking groups are using AI for phishing, identity spoofing, malware creation, and software supply chain attacks.

MS examined the level of AI use at eight North Korean hacking groups and found that three had reached the highest tier of "operational adoption," integrating AI into routine attack tasks. Of the rest, four were in the "acceleration" phase, where AI use is spreading quickly, and one was in the "expansion" phase, with AI introduced into some tasks.

In phishing attacks targeting Korea, there were also cases of mass document production using AI. One North Korean hacking group created more than 100 PDF lure documents tailored to targets in August–September this year. Signs also indicated dozens of documents were generated within minutes. By quickly producing finely tailored documents for each target using AI, they increased the scale and efficiency of phishing attacks.

There were also identity-masquerading tactics exploiting the hiring market. MS confirmed that from June 8–12 this year, a North Korean hacking group sent fake job offers to workers in AI, Blockchain, and cybersecurity using three front companies. It is seen as a method of scouting targets by posing as recruiters of specialized talent to approach workers in particular industries.

AI is also being used to build attack tools. MS assessed that North Korean hacking groups may have used AI coding tools such as "Cursor" to help write malware, fix code errors, and develop techniques to evade security detection. They are moving to streamline even tasks that previously required specialized development skills by using AI tools.

There were also signs of attacks using AI agents. According to MS, the "Onyx Sleet" (known domestically as Andariel) and "Pearl Sleet" hacking groups under North Korea's Reconnaissance General Bureau have been using "ARTEX," an open-source AI penetration-testing framework, in real operations since late October. This indicates an evolution to the stage of deploying AI-based tools in the attack process to support intrusion work.

However, MS assessed that while North Korean hacking groups are increasing the speed and efficiency of existing attacks through AI, they have not yet reached the stage of fully autonomous attacks that carry out the entire operation without human involvement.

MS advised corporations to thoroughly verify the identity and work history of job applicants and to strengthen security systems and malware detection capabilities that can respond to tailored phishing attacks.