North Korea’s hackers using AI for attacks, cybersecurity firm says

The attacks have used AI to automate the creation of malicious files disguised as legitimate documents, such as research reports and invitations, Seoul-based Genians said. To avoid detection, Kimsuky has used open-source tools such as Ollama, GPT-4All, and Msty to run large language models.

Kimsuky and other North Korean state-linked groups have been blamed for numerous cyberattacks in recent years, many of them aimed at extracting financial gains. Jenny Town, a senior fellow at the Stimson Center in Washington, DC, said the development was not surprising given North.

What Happened

The cybersecurity report comes as rapid advances in AI stoke fears about the potential for harm by bad actors and systems going rogue. US researchers last week announced that they used AI to create viruses not found in nature for the first.

• Kimsuky, a hacking group linked to North Korea’s intelligence services, has used AI-generated documents in a “pattern” of spear-phishing attacks since 2026, the South Korean cybersecurity firm Genians said in the report released on.

• North Korean hackers stole cryptocurrency worth more than $2bn in the first nine months of 2025, according to a report by British blockchain analytics firm Elliptic.

• In 2014, North Korea was identified by US authorities as the culprit in the hacking of Sony Pictures, which drew Pyongyang’s ire by lampooning North Korean leader Kim Jong Un in the comedy film.

Key Details

You no longer need hacking skills or a master’s degree in computer science.

• Hofmann, a criminal and intelligence analyst who specialises in cybercrime, said AI had led to a seismic shift in cybercrime by lowering the bar for bad actors to carry out malicious activity.

What Reports Say

Coverage of the story so far points to:

• Continued reporting by Al Jazeera as more details emerge