North Korea’s Kimsuky Uses Local AI to Target Crypto and Financial Firms
TL;DR:
- Kimsuky, the North Korean hacker group, built and operated three local LLM environments using Ollama, GPT4All, and Msty to carry out attacks without exposing data to the cloud.
- South Korean cybersecurity firm Genians detected that Kimsuky uses generative AI to produce phishing documents targeting crypto and fintech companies.
- North Korean hackers stole $2.02 billion in cryptocurrencies in 2025, including $1.5 billion taken from the Bybit exchange.
Kimsuky, the hacker group backed by the North Korean state, incorporated local artificial intelligence environments into its arsenal of cyberattacks targeting cryptocurrency companies and financial services. This was revealed in a report published by Genians, a cybersecurity firm headquartered in South Korea.
According to the report, Kimsuky built and operated three local large language model (LLM) environments using the platforms Ollama, GPT4All, and Msty. These tools allow fully offline operation and support retrieval-augmented generation, enabling attackers to run queries without sending data to external cloud services, thus eliminating any digital trace on third-party infrastructure.
… Continue reading the full article at the original source below.
