North Korea’s Kimsuky Turns to AI as Crypto Firms Face New Threats

Kimsuky appears to be researching ways to use existing AI technology in its attack operations, including malware development, data analysis, and the advancement of attack techniques. Kimsuky has been setting up local AI environments as it looks for ways to bring artificial intelligence into its cyberattack operations. The North Korea-linked threat actor, which has frequently targeted the cryptocurrency and financial sectors, was found to have established local LLM environments using Ollama, GPT4All, and Msty. Genians said the local approach prevents conversation data from being transmitted to external AI services, thereby reducing the risk of external exposure. AI Added to Crypto Attack Playbook According to the report, the activity showed the group was building capabilities to integrate artificial intelligence into its attacks. In GPT4All, investigators detected a database linked to its LocalDocs feature. The cybersecurity firm said the evidence indicates that the threat actor may have attempted to connect documents in its possession to an AI system and use them as a knowledge source. The group also collected libraries and frameworks that can integrate artificial intelligence into...