North Korea’s Kimsuky folds in AI into cyberattacks targeting crypto and finance
·2 min read
Compiled by KHAO Editorial
— aggregated from 2 sources + 4 references discovered via search.
See llms.txt for citation guidance.
✓ KHAO Verified
North Korean hacker group Kimsuky is using local AI systems to target cryptocurrency and financial firms with sophisticated cyberattacks, according to a report released Monday by Genians.
Key facts
North Korean hackers stole $2.02 billion worth of cryptocurrency last year, including the $1.5 billion hack of Bybit crypto exchange, according to Chainalysis
The recent $100 million exploit of Coldcard bitcoin hardware wallets is suspected to stem from an obscure vulnerability that AI uncovered
Hackers are becoming ever more sophisticated with the advent of AI, NEAR Protocol Co-founder Illia Polosukhin said that AI is supercharging hackers' ability to find software vulnerabilities faster
The South Korean cybersecurity firm found evidence that the group built and operated three local large language model (LLM) environments using Ollama, GPT4All, and Msty
Summary
The South Korean cybersecurity firm found evidence that the group built and operated three local large language model (LLM) environments using Ollama, GPT4All, and Msty. These tools allow offline operation and support retrieval-augmented generation, enabling hackers to make queries without sending data to external cloud services. The group has also collected libraries and frameworks to embed language models into custom software, along with the AI coding assistant Cursor and speech-to-text tools. "This provides concrete evidence that the Kimsuky-affiliated threat actor is moving beyond one-off experimentation with AI and is continuously preparing to integrate the technology into actual attack capabilities," Genians noted.