Microsoft: 3 North Korean hacking groups have fully integrated AI into attack workflows

On October 30, Yonhap News Agency reported that the Microsoft Threat Intelligence team analyzed the AI application maturity of eight North Korean hacking groups. Three have entered the "Operational Consolidation" stage, which is the highest level in the four-tier classification. Another four groups are in the "Accelerating" stage, and one is in the "Scaling" stage. Between August and September, one group generated over 100 customized PDF decoy documents targeting South Korean users, with some documents capable of being mass-produced into dozens of copies within minutes.

According to South Korean security firm Genians, the North Korean hacking group Kimsuky established local large language model (LLM) and RAG environments in August this year, leaving extensive usage records for the AI code editor Cursor. The Microsoft report also noted that these groups may have utilized the agentic AI penetration testing tool ARTEX. Microsoft simultaneously assessed that these groups have not yet reached the stage of fully autonomous attacks. The actual impact of AI on attack success rates and costs remains inconclusive.

According to analysis by US security firm TRM Labs, approximately $6.36 billion across 10 Binance blockchain wallets was stolen in about 20 minutes, with the agency attributing the incident to the North Korean group TraderTraitor. It has not yet been confirmed whether AI was used in this attack.