Back En.Vijesti.Me

North Korean hacking group develops AI tools for cyberattacks

En.Vijesti.Me • August 10, 2026

Genius said it found evidence that the North Korea-linked Kimsuki group had deployed tools to locally run and manage AI models, including Ollama, GPT4All and Msty, along with a document technology known as -assisted generation, or RAG.

A North Korean hacking group has developed tools based on large-scale language models and amassed software that could help automate cyberattacks, analyze stolen material and craft more convincing phishing campaigns, a South Korean cybersecurity company said.

The company Genius said it found evidence that the North Korea-linked Kimsuki group had deployed tools to locally run and manage AI models, including Ollam, GPT4All and Msty, along with a document technology known as -assisted generation, or RAG, Reuters reports.

According to the company, these tools could allow operators to process documents without sending sensitive data to external artificial intelligence services.

On the infrastructure he links to that campaign, Jenijans also found development frameworks for AI agents, speech-to-text software, as well as Cursor, a tool for programming with the help of artificial intelligence.

The findings indicate that Kimsuki is moving beyond using generative AI to craft phishing baits and is developing capabilities to integrate existing AI models into malware development, data analysis, and attack automation, Jennijans said in the report.

The company also said it found fake documents on finance and cryptocurrency topics that appeared to be generated using artificial intelligence. The materials were designed to look like legitimate investment reports and other business documents, Reuters reported.

The company's findings could not be independently confirmed.

North Korea has been using state-linked cyber units for years for espionage, financial theft and revenue generation, according to US and South Korean authorities, as well as cybersecurity experts.

The US Treasury Department imposed sanctions on Kimsuki in 2023, describing it as a cyber-espionage group controlled by the North Korean government that collects intelligence in support of Pyongyang's strategic interests.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kimsuky Expands AI Capabilities for Cyberattacks The North Korean hacking group Kimsuky has developed local AI tools to enhance its cyberattack capabilities, as reported by Genians Security Center on August 10, 2026. The group is utilizing large language models (LLMs) such as Ollama and GPT4All, alongside retrieval-augmented generation (RAG) technology, to automate phishing campaigns and analyze stolen data without sending sensitive information to external services. Recent findings indicate that Kimsuky is creating sophisticated phishing lures that mimic legitimate financial documents, making them harder to detect. This marks a shift from previous tactics that primarily relied on reusing stolen documents. The group has been targeting sectors related to finance and cryptocurrency, utilizing AI-generated materials to enhance the effectiveness of its attacks. The U.S. Treasury had previously sanctioned Kimsuky in 2023 for its cyber-espionage activities supporting North Korea's strategic goals. 49 sources 78

Extracted Entities

North Korean hacking group develops AI tools for cyberattacks

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Companies (1)

Countries (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)