North Korea’s hackers using AI for attacks, cybersecurity firm says

What the report says

South Korea-based cybersecurity firm Genians says the North Korean hacking group Kimsuky has been using artificial intelligence to strengthen spear-phishing operations, including AI-generated documents meant to look like legitimate research reports and invitations. Al Jazeera reported that the firm identified a pattern of such activity in attacks targeting military, diplomatic and academic circles, with the report released on Monday. According to Genians, the group has also relied on offline tools such as Ollama, GPT-4All and Msty to run large language models without internet access, a tactic intended to make the activity harder to detect.

The report said the shift is important because it shows AI being used not just to polish fake documents, but to automate and scale social-engineering attacks. Al Jazeera noted that Kimsuky is linked to North Korea’s intelligence services and has been associated with other cyber operations in recent years, many of them financially motivated. The article also referenced broader concerns about North Korean cyber activity, including past cryptocurrency thefts and the 2014 Sony Pictures hack attributed by US authorities to North Korea.

Experts quoted by Al Jazeera said the development fits a wider trend in which generative AI lowers the barrier for cybercrime. They cautioned that state-backed and other threat actors are likely to use AI more often to speed up attacks and make them more convincing. As background, the story places the findings within a growing global debate over how rapidly advancing AI tools could be misused for cyber operations.