North Korean Hackers Use Local AI Systems to Boost Crypto Attacks
Kimsuky group employs local AI models in attacks targeting crypto and financial sectors.
1Kimsuky's AI Infrastructure
South Korean cybersecurity firm Genians discovered that North Korea-linked hacking group Kimsuky is using local large language models (LLMs) like Ollama, GPT4All, and Msty. The group is also testing technologies such as RAG (retrieval-augmented generation) and the AI coding assistant Cursor. These findings suggest Kimsuky is preparing to integrate AI into various stages of its attack processes, not just for simple tasks. Local AI models give attackers greater control over their data and operations.
2AI-Generated Fraud Documents
Genians found that Kimsuky uses AI-generated documents related to crypto assets, financial investments, and game development. These documents feature professional layouts and natural language that closely resemble real business letters. Researchers discovered metadata links to python-docx or WPS Office in some English-language documents, along with surprisingly regular creation/modification date patterns, indicating an automated document production process.
3Advanced Phishing Tactics
Kimsuky has moved beyond simple phishing emails to using professionally crafted investment strategy documents that mimic a Korean fintech site. These documents contain hidden LNK files that, when executed, reveal PowerShell loaders or command-line instructions. The attackers also employ techniques like accessing GitHub Raw Contents API and using unusual personal access tokens.
4Operation GitPower Campaign
Genians has named this activity Operation GitPower, noting it builds on tactics previously associated with the FlowerPower campaign. Researchers suggest we're entering an era where AI could be used for malware creation, information analysis, and attack automation, marking a significant shift in cyber threat capabilities.
5Targets and Delivery Chain
Kimsuky continues targeting organizations and professionals in crypto assets, finance, diplomacy, security, and international affairs. Attacks are carried out using malicious LNK shortcuts disguised as valid ZIP archives. Defense teams need to remain vigilant against unusual execution arguments in LNK files and hidden PowerShell commands.
6Advantages of Local AI
Using local AI models gives Kimsuky the advantage of reduced dependence on third-party cloud AI services. Sensitive questions, program development, and collected information can be analyzed without relying on external services. This enhances operational security while enabling more complex attack scenarios.
7Industry Risks
Kimsuky's AI-powered attacks pose a serious threat, particularly to organizations in crypto and financial sectors. The realism of AI-generated documents could bypass traditional security measures. Industry professionals need increased vigilance, especially regarding unexpected investment offers and partnership proposals.
8Defense Recommendations
Genians advises defense teams to monitor unusual activities like GitHub Raw Contents API access, atypical personal access tokens, and .data (encrypted) arguments. Additional security measures against LNK file and PowerShell command usage are crucial, along with employee training on AI-powered fraud techniques.
Original article: CryptoNinjas — Kuzey Koreli Hackerlardan Yerel AI Sistemleriyle Kripto Saldırıları