North Korean Hacking Groups Leverage AI for Advanced Cyberattacks
State-sponsored hackers from North Korea, particularly the groups Kimsuky and APT45, are advancing their cyberattack methods by integrating generative AI technologies. This evolution signifies a departure from traditional tactics like phishing emails and brute-force attacks to the development of custom cyberattack tools powered by AI. Cybersecurity firms and government agencies have noted this alarming trend, highlighting the potential dangers posed by these state-sponsored actors who are now treating large language models as critical components of their cyber infrastructure.
Kaspersky reported that Kimsuky utilized a large language model to create a malware strain known as HelloDoor, which exhibited characteristics indicative of AI involvement, such as emoji-laden comments and grammatical errors typical of machine-generated text. Meanwhile, APT45 has been documented employing a technique referred to as "recursive prompting," where they send numerous repetitive prompts to large language models to systematically analyze known software vulnerabilities and validate existing exploits.
The application of AI extends beyond mere code generation. Kimsuky has reportedly used ChatGPT to forge fake South Korean military identification documents, which were then employed in phishing attacks aimed at impersonating defense institutions. This tactic is designed to deceive targets into revealing sensitive information or clicking on malicious links.
Another group, Famous Chollima, has taken a different approach by utilizing AI to create deepfakes and fabricate professional profiles for job-related intrusions. A report from CrowdStrike revealed that this group accounted for a significant portion of state-backed hacking incidents targeting the tech sector, with operations that involved creating convincing fake identities to gain access for espionage or theft.
In June 2026, South Korea's National Cyber Security Center issued a warning regarding the progression of North Korean hacking groups toward what is termed "agentic AI," which refers to systems capable of autonomously executing cyberattacks without ongoing human oversight. The agency cautioned that such systems could potentially carry out thousands of malicious actions per second.
Cybersecurity researchers have characterized AI as a "force multiplier" for North Korean operations, enabling broader and more efficient campaigns with significantly reduced human effort. South Korea remains a primary target for these cyberattacks due to geopolitical tensions, with Kimsuky actively targeting South Korean government certification infrastructure as recently as mid-2026. Historically, North Korean cyber operations have been driven by both profit and intelligence objectives, with groups like the Lazarus Group linked to some of the largest cryptocurrency heists in history. The integration of AI capabilities into these already financially motivated groups raises concerns about the scale and speed of potential cybercrimes.
