Microsoft’s threat intelligence team has assessed how eight North Korean hacking groups are using artificial intelligence, according to a Yonhap report cited by ChainCatcher. The review found that three groups have reached the “operationalization” stage, the highest level in Microsoft’s four-tier framework. Four others were placed in the “acceleration” stage, while one group was classified in the “expansion” stage.
The report said one of the groups generated more than 100 customized PDF lure documents targeting South Korean users between August and September, with some batches producing dozens of files within minutes. South Korean security firm Genians separately disclosed that Kimsuky had built a local large language model and retrieval-augmented generation, or RAG, environment in August this year, and left extensive records showing use of the AI coding editor Cursor.
Microsoft also said the groups may have used the agentic AI penetration-testing tool ARTEX. At the same time, the company assessed that these actors have not yet reached fully autonomous attack capability, and that the real impact of AI on attack success rates and costs remains unclear. TRM Labs also linked a theft involving about $6.36 billion from 10 Binance blockchain wallets to the North Korean group TraderTraitor, though it has not been confirmed whether AI was used in that incident.
Microsoft’s threat intelligence team has assessed the level of AI adoption across eight North Korean hacking groups, according to a Yonhap report cited by ChainCatcher. Three of the groups have reached the “operationalization” stage, the highest level in Microsoft’s four-tier framework.
Another four groups were classified in the “acceleration” stage, while one was placed in the “expansion” stage.
Microsoft’s analysis said one of the groups generated more than 100 customized PDF lure documents targeting South Korean users between August and September. Some of those documents could be produced in batches of dozens within minutes.
South Korean cybersecurity firm Genians said North Korean hacking group Kimsuky had already built a local large language model and a retrieval-augmented generation, or RAG, environment in August this year. Genians also found extensive records showing use of the AI code editor Cursor.
Microsoft’s report added that these groups may have used ARTEX, an agentic AI penetration-testing tool.
Microsoft also assessed that the groups have not yet reached the stage of fully autonomous attacks, and said the actual effect of AI on attack success rates and costs remains uncertain.
Separately, U.S. security firm TRM Labs said about $6.36 billion was stolen from 10 Binance blockchain wallets in roughly 20 minutes, and the firm attributed the incident to the North Korean group TraderTraitor. It has not been confirmed whether AI was used in that attack.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
