Kathmandu— North Korean state-backed hackers are increasingly utilizing artificial intelligence to enhance their cyberattack capabilities, according to a report released Monday by Seoul-based cybersecurity firm Genians. The hacking group Kimsuky, associated with North Korea’s intelligence services, has been employing AI-generated documents in spear-phishing attacks since 2026, automating the creation of convincing malicious files disguised as legitimate research and invitations. This development marks a shift towards automated social engineering attacks, lowering the technical barrier for cybercriminals and potentially escalating the frequency and sophistication of these threats.

AI-Powered Spear Phishing Tactics

Genians’ report details how Kimsuky is leveraging AI to generate highly polished documents on various topics with remarkable speed. This allows them to create convincing lures for spear-phishing campaigns, targeting individuals in the military, diplomatic circles, and academia. To evade detection, the group utilizes open-source tools like Ollama, GPT-4All, and Msty to run large language models offline, eliminating reliance on internet connectivity during document creation.

Escalating Cybercrime Landscape

Experts suggest this adoption of AI by North Korean hackers is a natural progression given the nation’s established history of cyber activity. Jenny Town, a senior fellow at the Stimson Center in Washington, DC, stated that “North Korea’s hackers and programmers are more than capable of utilising and exploiting various AI tools to enhance their efforts.” Mark T. Hofmann, a criminal and intelligence analyst specializing in cybercrime, emphasized that AI has fundamentally altered the landscape of cybercrime by reducing the skill level required for malicious activity.

Financial Motives and Past Attacks

Kimsuky and other North Korean state-linked groups have been implicated in numerous cyberattacks over recent years, often motivated by financial gain. A report from British blockchain analytics firm Elliptic estimates that North Korean hackers stole cryptocurrency valued at over $2 billion during the first nine months of 2025. The group also gained notoriety for the 2014 hack of Sony Pictures Entertainment, which followed the release of the satirical film “The Interview” depicting North Korean leader Kim Jong Un.

The increasing use of AI in cyberattacks by state-sponsored groups like Kimsuky signals a growing trend that is likely to become more prevalent in the coming years, requiring heightened vigilance and advanced cybersecurity measures.

(With inputs from Al Jazeera)

Originally published on abcnews.com.np.