North Korean Hacking Group Kimsoo-ki Builds Local AI Tools for Cyber Operations

A South Korean cybersecurity company stated on Monday that a North Korea–affiliated hacking group has built specialized tools for large language models, enabling automation of cyberattacks, analysis of exfiltrated materials, and more convincing phishing campaigns.

Local AI Infrastructure for Offensive Operations

The firm Genians identified evidence indicating that the group Kimsoo-ki—linked to North Korea—developed capabilities to run and manage artificial intelligence models locally. These include Ollama, GPT-4-All, and Mistral, along with document-search technology known as retrieval-augmented generation, according to Reuters.

According to Genians, this local deployment allows operators to process documents without transmitting sensitive information to external AI services.

Expanded Use Beyond Phishing

In its report, the company noted that Kimsoo-ki has moved beyond using generative AI solely for crafting phishing tools. The group is now building capabilities to integrate existing AI models into malware development, data analysis, and attack automation.

Independent verification of the findings has not been possible.

U.S. and Allied Assessments

U.S. and South Korean authorities assert that North Korea has deployed state-linked cyber units for years to conduct espionage, theft, and financial gain.

The U.S. Department of the Treasury imposed sanctions on Kimsoo-ki in 2023, designating it as a North Korean government–affiliated cyber espionage group.