Experts warn North Korean hackers are increasingly using AI to build smarter and more devious cyberattacks

Date:
Mon, 10 Aug 2026 11:25:00 +0000

Description:
In cybercrime, AI is used for more than simply drafting phishing emails and defenders need to adapt, new report states.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Kimsuky used local AI tools to evade monitoring and enhance operations Researchers observed extensive AI-driven capability building across the groups infrastructure Defenders
urged behavior-based detection to spot evolving AI-enabled threats North Korean hackers have found a way to use Generative Artificial Intelligence (GenAI) to supercharge their activities without tipping off the tools maintainers.

When people use AI tools like ChatGPT or Claude, their activities can be (at least to some extent) tracked and curbed - with OpenAI recently identifying and terminating multiple ChatGPT accounts used in phishing and human trafficking. That is why Kimsuky - a known state-sponsored North Korean
threat actor, used Ollama, GPT4All and Msty locally, allowing them to process documents without sending any sensitive information to outside AI services. Latest Videos From TechRadar Watch full video here: "Consistent process of capability development" The attacks were spotted by security researchers Genians who conducted months of tracking and log analysis on the infrastructure utilized as C2 in this campaign, to identify the tools they used.

Aside from the three LLMs, they also used retrieval augmented generation
(RAG) tools for document search, as well as AI agent development frameworks, text-to-speech software, and an AI-assisted coding tool called Cursor. You
may like Experts warn hackers are using AI chatbots to write malware using natural language Hackers used AI to discover and weaponize a zero-day for the first time Amazon flags North Korean hacker group as being behind the surge
in open source supply chain attacks

Using AI to write malicious code is not as simple as it sounds, due to
various guardrails set up by the developers. As a result, AI in crime has
been mostly limited to drafting phishing emails and crafting
authentic-looking but malicious landing pages. However, Kimsuky has shown
that AI in cybercrime continues to evolve and is becoming an ever-greater threat.

What was observed in the threat actor's infrastructure was not merely
evidence of several documents being created with AI, but a consistent process of capability development: establishing local LLM runtime environments, configuring RAG based on documents in the actor's possession, collecting AI agent development frameworks, and acquiring libraries for integration with external commercial AI services, Genians concluded. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

As a result, defenders must move from content-based assessment to behavior-based detection, the researchers warned, saying this should serve as the fundamental premise of security recommendations.

In addition to indicator of compromise (IoC)-based detection, organizations should contextually correlate the sequence of anomalous activities following LNK execution, including PowerShell execution, persistence establishment, and external communications, to assess the overall threat level. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/experts-warn-north-korean-hackers-are-i ncreasingly-using-ai-to-build-smarter-and-more-devious-cyberattacks


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)