It has been observed that the North Korean hacking group 'Kim Sung-ki' attempted to utilize generative AI not only for creating phishing documents but also for analyzing stolen information and automating attacks.
On the 10th, Genians announced that its analysis of Kim Sung-ki's recent attack activities confirmed traces of attackers directly building local large language model (LLM) and retrieval-augmented generation (RAG) environments and operating AI-based development tools.
Kim Sung-ki is a hacking group known to be under the North Korean Reconnaissance General Bureau. It has primarily used spear-phishing attacks by impersonating diplomatic or security experts and business contacts, sending malicious files. When users execute shortcut (LNK) files resembling documents within compressed archives attached to emails, PowerShell scripts run in the background.
Previous AI usage by North Korean hacking groups focused on preparatory stages of attacks, such as creating forged images and audio or drafting phishing bait documents. This time, however, it was confirmed that attackers built local LLMs capable of operating internally without transmitting data to external services.
Genians analyzed that attackers likely used these tools to analyze stolen documents, extract necessary information, and automate repetitive attack tasks.
In the attack environment, local LLM execution and management tools such as 'Ollama', 'GPT4All', and 'Msty', RAG configuration environments, AI agent development frameworks, and speech recognition tools were discovered. Records also confirmed that the AI coding tool 'Cursor' was installed to edit documents used in attacks and review generated outputs.
Attack targets focused on the virtual asset and financial sectors. Attackers distributed malicious documents disguised as investment strategy reports and financial materials. Genians explained that these documents appeared to be created using generative AI, with writing styles and formats so sophisticated that they were difficult to distinguish from actual business documents.
During analysis, it was also discovered that attackers attempted to verify the exposure of personal information, including virtual asset wallet details, Gmail accounts, and website registration histories.
Moon Jong-hyun, head of Genians Security Center, stated, "This case demonstrates how a state-sponsored hacking group has built local LLMs and AI development environments to integrate AI into actual attack systems." He added, "Endpoint detection and response (EDR)-based threat hunting systems that focus on detecting execution behaviors rather than document content are crucial."
Genians shared the findings of this analysis with domestic and international cooperation frameworks, including the Korea Internet & Security Agency (KISA) Threat Intelligence Network Consortium. The full report is available on Genians' official website.
in TECH
