South Korean media: North Korean hacker groups have fully integrated AI into their cyberattack processes, enabling the mass generation of customized phishing documents within minutes.

October 30 - According to Yonhap News Agency, Microsoft's threat intelligence department recently analyzed and found that among the 8 North Korean hacker groups assessed, 3 have reached the highest stage of integrating AI into daily attack operations, while another 4 are in the stage of rapidly expanding AI applications. Among them, one North Korean hacker group generated over 100 customized PDF decoy documents targeting South Korean users between August and September this year, in some cases producing dozens within minutes.

AI can generate personalized phishing materials based on the target's occupation, interests, and work environment, improving attack preparation efficiency. The report also noted that North Korean hacker groups are expanding AI applications to information analysis, malware development, and attack automation. South Korean cybersecurity firm Genians previously found that the North Korean hacker group Kimsuky is suspected of building a local large language model (LLM) and retrieval-augmented generation (RAG) environment, leaving traces of using AI programming tools such as Cursor.

The Microsoft report also mentioned that relevant groups may use AI programming tools to generate code, fix errors, and develop detection evasion techniques, and have used the agentic AI-based penetration testing tool ARTEX in operations. Meanwhile, the report cited TRM Labs' analysis stating that the North Korean hacker group TraderTraitor is believed to be behind the recent attack on Binance.

The incident involved 10 Binance blockchain wallets, with approximately $6.36 billion in assets stolen in about 20 minutes. TRM Labs suggested that the attack may have involved the hot wallet transaction signing system that processes customer withdrawals; Binance stated that attackers may have entered the internal environment by compromising the laptops of development and operations engineers. However, there is currently no evidence confirming that AI was used in the Binance attack. Microsoft also noted that North Korean hacker groups have not yet reached the stage of fully autonomous attacks. The report emphasized that while AI has improved attack preparation and execution efficiency, its actual impact on attack success rates and costs remains to be verified.