Microsoft: North Korean hackers use AI to mass-generate phishing documents; fake recruitment and malicious code development have been implemented.

October 30 - According to Yonhap News Agency, a report released by Microsoft Threat Intelligence on the 29th shows that North Korean hacker groups are using artificial intelligence to accelerate cyber attacks on South Korean users, expanding from customized phishing documents, fake job recruitment and identity disguise to malicious code development and software supply chain attacks.

Microsoft assessed the AI adoption levels of 8 North Korea-related hacker groups: 3 of them have reached the highest "operationalized" stage among four levels, integrating AI into daily attack processes; another 4 are in the "accelerating" stage, and 1 is in the "expanding" stage. The report said that one group generated more than 100 customized PDF lure documents targeting different victims between August and September this year, with dozens produced in batches within minutes in some cases. Between June 8 and 12 this year, there was also a case in which 3 disguised companies were used to launch fake job recruitment invitations at AI, blockchain and cybersecurity professionals.

In addition, Microsoft analyzed that North Korean hackers may use AI coding tools such as Cursor to assist with code generation, debugging and detection evasion; "Onyx Sleet" (called Andariel by South Korea) and "Pearl Sleet" under North Korea's Reconnaissance General Bureau have been using the open-source AI penetration testing framework ARTEX in real-world operations since late October. Microsoft believes that although these groups have used AI to improve attack speed and efficiency, they have not yet entered the stage of fully autonomous attacks, and recommends that enterprises strengthen job applicant identity verification, phishing protection and malicious code detection.