Summary
- Kimsuky operates private AI environments using Ollama, GPT4All, and Msty to support malware development, data analysis, and attack automation capabilities.
- Generative AI helps Kimsuky create convincing crypto phishing documents featuring professional formatting, natural language, investment themes, and fintech-related content.
- North Korean hackers stole $2.02 billion in cryptocurrency during 2025, while AI could strengthen vulnerability discovery and established infiltration methods.
North Korean hacking group Kimsuky is using private artificial intelligence systems to strengthen cyberattacks targeting cryptocurrency and financial companies. South Korean cybersecurity firm Genians identified three local large language model environments connected to the group. Researchers believe the infrastructure could support phishing, malware development, data analysis, and attack automation.
Genians identified Ollama, GPT4All, and Msty among the locally operated platforms linked to Kimsuky’s activities. These tools allow hackers to run AI models without relying on external cloud services.
Additionally, the platforms support retrieval-augmented generation, allowing operators to query information stored within controlled environments. This setup could reduce external exposure while giving attackers greater control over sensitive information used during operations.
Researchers also uncovered libraries and frameworks that can integrate language models directly into custom software. Kimsuky collected the AI coding assistant Cursor alongside speech-to-text tools and other development resources.
Significantly, Genians believes the activity goes beyond occasional experimentation with artificial intelligence. Instead, the infrastructure indicates preparations to integrate existing AI technology deeper into established cyberattack operations.
However, researchers found no evidence that Kimsuky is developing entirely new artificial intelligence models. The group appears focused on adapting available open-source technologies for malicious purposes.
Also Read: Peter Brandt Leans Bearish on Bitcoin as $58,000 Retest Risk Builds
Private AI Systems Support More Convincing Crypto Phishing Attacks
Cryptocurrency companies face additional risks because Kimsuky is also using generative AI to create convincing phishing documents. These materials cover digital assets, investment strategies, fintech services, and other subjects relevant to financial targets.
Some documents closely imitated materials associated with a Korean AI-powered investment platform. Moreover, they featured natural language, consistent formatting, and professional designs that could make fraudulent communications appear legitimate.
Such techniques could help attackers deceive employees into opening malicious documents or providing access to sensitive corporate information. They also demonstrate how AI can strengthen traditional phishing methods without requiring entirely new attack techniques.
North Korean hackers already represent a major security threat across the cryptocurrency industry. Chainalysis estimated that North Korean attackers stole approximately $2.02 billion in cryptocurrency during 2025.
That total included the $1.5 billion Bybit exchange breach. North Korean cyber operations have also used phishing emails and embedded IT workers to access cryptocurrency companies. Besides stealing digital assets directly, infiltrators can target internal information, credentials, infrastructure, and other resources needed for more complex attacks.
AI Gives Established Cyberattack Methods Greater Reach
Artificial intelligence could increase the effectiveness of these operations by accelerating research, coding, document creation, and vulnerability discovery. NEAR Protocol co-founder Illia Polosukhin has warned that AI can help hackers discover software vulnerabilities faster than security teams can patch them.
Consequently, cryptocurrency firms may face attackers combining established infiltration techniques with locally operated AI systems capable of supporting several attack stages. Genians’ findings show that Kimsuky does not need proprietary AI models to expand its capabilities. Existing tools can already support phishing preparation, software development, information processing, and automation.
Private AI infrastructure therefore adds another challenge for cryptocurrency firms protecting digital assets and sensitive internal systems from North Korean cyber operations.
Also Read: Crypto Market Holds Firm as Bitcoin Stays Above $65K, Bubblemaps Surges 90%
