Kimsuky Hacking Group Uses AI Coding Agent for Malware Decoys

• •Kimsuky has confirmed the use of the AI coding agent 'opencode' for creating malware decoys.
• •The attack method involved distributing emails with decoy documents disguised as financial materials.
• •This marks the first detection of Kimsuky utilizing AI coding agents in its cyber operations.

The North Korea-linked hacking group Kimsuky has been confirmed to use an open-source AI coding agent named 'opencode' to create decoy documents for malware distribution. A South Korean security firm, Genians, reported that analysis of 13 malicious files revealed that these documents were disguised as financial and insurance-related materials to lure users into activating malware. The metadata of the decoy files indicated they were generated by the AI agent, with both 'creator' and 'producer' fields showing 'opencode.' This marks the first confirmed use of an AI coding agent by Kimsuky, which had previously been known to utilize large language models for similar purposes. The attack method involved sending emails with compressed files containing these decoy documents, which, when clicked, activated the malware. The findings highlight a significant evolution in Kimsuky's tactics, indicating a shift towards automated attack preparation using AI technology.