Microsoft: North Korean hacking group uses AI to mass-produce targeted phishing files, over 100 decoy documents discovered

On Oct. 30, according to Yonhap News Agency, Microsoft's threat intelligence department released a report yesterday stating that North Korean hacker organizations are expanding the use of artificial intelligence (AI) in cyberattacks, involving phishing attacks, identity spoofing, malware development, and software supply chain attacks. Microsoft analyzed eight North Korean hacker organizations, three of which have integrated AI into their daily attack activities, reaching the highest stage of AI application.

The report noted that between August and September this year, one group utilized AI to create over 100 customized PDF phishing lure files targeting South Korean users, with some cases generating dozens of files within minutes. Additionally, North Korean hackers are using AI to carry out fake recruitment and identity spoofing, and may be leveraging AI programming tools such as Cursor to assist in malware development. Microsoft also found that Onyx Sleet and Pearl Sleet, affiliated with North Korea's Reconnaissance General Bureau, have begun using the open-source AI penetration testing framework ARTEX in their operations since late October. Microsoft pointed out that these organizations have not yet reached the stage of fully autonomous attacks.