North Korean hackers use local AI to automate attacks on crypto firms

cryptonews

Aug 10

North Korea-linked hacking group Kimsuky has built three local AI environments as part of preparations for cyberattacks targeting cryptocurrency and financial companies, according to new cybersecurity...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Most Discussed

{"basename":"","ssrTDKData":{"titleTemplate":"%s - Tiger Brokers","title":"Tiger Brokers HK | Online Trading in stocks, bonds & ETFS","description":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","keywords":"tiger trading,tiger security,tiger broker hk,tigers co ltd,tiger trade hk,tiger brokers hk,stock broker,securities broker,online brokerage,hong kong broker,hk broker,online stock trading,online trading platform,stock trading platforms,trading application,stock trading,stock trading hong kong,buying stocks in hong kong,tiger brokers","social":{"ogDescription":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","ogImage":"https://c1.itigergrowtha.com/portal5/static/media/og-logo.0a0bd8dc.png","ogUrl":"https://www.gotigerhk.com/news/2658982457"},"companyName":"Tiger Brokers"},"pageData":{"isMobile":false,"isTiger":false,"isTTM":true,"region":"HKG","license":"TBHK","edition":"fundamental"},"isCrawlerRequest":true,"__swrFallback__":{"@#url:\"https://stock-news.skytigris.cn/v3/news\",params:#id:\"2658982457\",edition:\"fundamental\",auth_exemption:1,,,undefined,":{"share":"https://ttm.financial/m/news/2658982457?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-10 17:56","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2658982457","market":"sg","top_or_hot":-1,"title":"North Korean hackers use local AI to automate attacks on crypto firms","media":"cryptonews","content":"<div>\n<p>North Korea-linked hacking group Kimsuky has built three local AI environments as part of preparations for cyberattacks targeting cryptocurrency and financial companies, according to new cybersecurity...</p>\n\n<a href=\"https://crypto.news/north-korean-hackers-use-local-ai-to-automate-attacks-on-crypto-firms/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>North Korean hackers use local AI to automate attacks on crypto firms</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nNorth Korean hackers use local AI to automate attacks on crypto firms\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-10 17:56 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/north-korean-hackers-use-local-ai-to-automate-attacks-on-crypto-firms/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>North Korea-linked hacking group Kimsuky has built three local AI environments as part of preparations for cyberattacks targeting cryptocurrency and financial companies, according to new cybersecurity...</p>\n\n<a href=\"https://crypto.news/north-korean-hackers-use-local-ai-to-automate-attacks-on-crypto-firms/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"TEKX","symbol_name":"SPDR Galaxy Transformative Tech Accelerators ETF","start_time":0,"source_url":"https://crypto.news/north-korean-hackers-use-local-ai-to-automate-attacks-on-crypto-firms/","article_id":"2658982457","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/north-korean-hackers-use-local-ai-to-automate-attacks-on-crypto-firms/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2658982457","pubTimestamp":1786355801,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"North Korea-linked hacking group Kimsuky has built three local AI environments as part of preparations for cyberattacks targeting cryptocurrency and financial companies, according to new cybersecurity research.Kimsuky has built three local AI environments using Ollama, GPT4All and Msty.The North Korea-linked group is using AI for malware development, data analysis and attack automation.Kimsuky has produced AI-generated phishing material targeting crypto, investment and fintech firms.North Korean hackers stole an estimated $2.02 billion in cryptocurrency during 2025.Genians, a South Korean cybersecurity firm, said in a report released Monday that it found evidence of Kimsuky operating local large language model environments through Ollama, GPT4All and Msty, giving the group access to AI tools that can run without relying on external cloud services.Kimsuky has built local AI systems for cyberattacks. Rather than developing new AI models, the activity examined by Genians centered on putti","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"TEKX":"SPDR Galaxy Transformative Tech Accelerators ETF","VTHR":"Vanguard Russell 3000 ETF","GDLC":"Grayscale CoinDesk Crypto 5 ETF","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","AIPO":"Defiance AI and Power Infrastructure ETF","AGIX":"通用人工智能 ETF-AGIX","BITQ":"Bitwise Crypto Industry Innovators ETF","BK4585":"ETF&股票定投概念","NCIQ":"HASHDEX NASDAQ CRYPTO INDEX US ETF","DIME":"CoinShares Altcoins ETF","ARTY":"ISHARES FUTURE AI & TECH ETF","BKIV":"BNY MELLON INNOVATORS ETF","QTOC":"Innovator Growth Accelerated Plus ETF - October","VGT":"信息技术ETF-Vanguard","BKCH":"AdvisorShares Sabretooth ETF","BITW":"Bitwise 10 Crypto Index ETF","BLOK":"Amplify Transformational Data Sharing ETF","CHAT":"ROUNDHILL GENERATIVE AI & TECHNOLOGY ETF","LFGY":"YieldMax Crypto Industry and Tech Portfolio Option Income ETF","DAPP":"VanEck Digital Transformation ETF","HECO":"SPDR Galaxy Hedged Digital Asset Ecosystem ETF","STCE":"Schwab Crypto Thematic ETF","BK4588":"碎股"},"translate_title":"朝鲜黑客使用本地人工智能自动攻击加密货币公司","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"BLOK":0.72,"VTHR":1.5,"BITQ":1.5,"LFGY":1.5,"DAPP":1.5,"ARTY":1.5,"HECO":0.72,"CRPT":1.5,"BKCH":1.5,"AIPO":1.5,"BKIV":0.63,"DIME":1.5,"AGIX":1.5,"BITW":1.5,"NCIQ":1.5,"STCE":1.5,"TEKX":1.5,"QTOC":1.5,"GDLC":1.5,"CHAT":1.5,"VGT":0.9},"content_text":"North Korea-linked hacking group Kimsuky has built three local AI environments as part of preparations for cyberattacks targeting cryptocurrency and financial companies, according to new cybersecurity research.\n\n\nSummary\n\n\n\nKimsuky has built three local AI environments using Ollama, GPT4All and Msty.\nThe North Korea-linked group is using AI for malware development, data analysis and attack automation.\nKimsuky has produced AI-generated phishing material targeting crypto, investment and fintech firms.\nNorth Korean hackers stole an estimated $2.02 billion in cryptocurrency during 2025.\n\n\n\nGenians, a South Korean cybersecurity firm, said in a report released Monday that it found evidence of Kimsuky operating local large language model environments through Ollama, GPT4All and Msty, giving the group access to AI tools that can run without relying on external cloud services.\nKimsuky has built local AI systems for cyberattacks\nRunning models locally allows operators to make queries without sending potentially sensitive attack information to third-party AI providers. According to the research, the environments also support retrieval-augmented generation, which can connect an AI model with additional information supplied by its operator.\nAlongside the three environments, researchers found libraries and frameworks that can embed language models into custom software. Kimsuky had also collected the AI coding assistant Cursor and speech-to-text tools as it assembled its AI infrastructure.\nRather than developing new AI models, the activity examined by Genians centered on putting existing open-source technology to work across malware development, data analysis and attack automation.\nThe firm assessed that the activity had moved beyond isolated tests because Kimsuky was continuously preparing to incorporate AI into operational attack capabilities. However, its findings did not show that the group was developing proprietary AI models from scratch.\nKeeping the models on local infrastructure could also allow the hackers to work with information without submitting it to external cloud systems, according to the report. The collection of supporting software indicates that the AI environments form part of a larger technical setup rather than functioning only as standalone chat tools.\nAI-generated phishing documents target crypto firms\nKimsuky has also continued using generative AI to prepare phishing material focused on cryptocurrency, investment strategies and fintech services, according to Genians.\nResearchers identified polished documents that closely copied material associated with a Korean AI-powered investment platform. The files used natural language, consistent formatting and professional design elements that the cybersecurity firm associated with AI-generated content.\nSuch material provides another use for the group’s AI infrastructure beyond coding and data processing. Instead of relying only on poorly written phishing emails, the operators can use generative tools to prepare documents designed around financial subjects relevant to their intended targets.\nThe findings add Kimsuky to a series of North Korea-linked operations using newer technical and social-engineering methods against the cryptocurrency industry.\nIn July, cybersecurity firm JUMPSEC reported that BlueNoroff, another North Korea-linked group, was operating fake Zoom and Microsoft Teams meetings that profiled cryptocurrency users before malware was delivered.\nJUMPSEC recovered source code from an active phishing kit after its operators accidentally exposed JavaScript source maps. The code contained wallet-scanning functions, operator controls, and separate malware delivery routes for Windows and macOS.\nOnce a target entered a fake meeting page, the system checked for Ethereum wallet connections and non-EVM wallets, including Solana tools, before sending the results to an operator panel. Windows implants could also identify browser extensions across Chrome, Edge, Brave, Opera, Vivaldi and Firefox variants, allowing operators to check for wallets such as MetaMask.\nThe attackers could then decide whether to continue the intrusion based on information gathered from the target, JUMPSEC found.\nNorth Korean hackers are combining AI with social engineering\nAI also appeared inside BlueNoroff’s fake meeting operation, although in a different role from the local models identified in the Kimsuky research.\nAccording to JUMPSEC, operators combined AI-generated headshots with body movements taken from previous meetings to create convincing participants for fake video calls. Victims could arrive through a Telegram account belonging to a real contact whose account had already been compromised, before receiving a Calendly invitation that redirected them to a fake meeting domain.\nDuring the call, an operator could display a prepared video, send messages about a supposed microphone problem, and trigger a fake Zoom software update. On Windows, the resulting ClickFix process used PowerShell and VBScript, while the macOS route delivered a fake meeting installer alongside information-stealing malware.\nArctic Wolf had previously identified more than 80 lookalike Zoom and Teams domains associated with related operations. About 80% of the targets it identified worked in crypto, blockchain finance or connected investment sectors, while founders and chief executives represented 45% of the identified targets.\nNorth Korean operations have also sought access from inside crypto companies rather than relying solely on phishing or malware.\nIn July, Consensys temporarily stopped product releases after discovering that a consultant linked to North Korea had gained access to its systems for roughly one month, according to Drop Site News.\nThe consultant, who operated under the name Tyler Knapp and used the GitHub handle “imyugioh,” contributed to core MetaMask platform code, including components connecting cryptocurrency users with third-party fiat payment providers.\nConsensys general counsel Matt Corva said a third-party service provider had introduced the consultant to the company. The company terminated his access after identifying the threat and said its investigation found no stolen assets or data, malicious code or impact on user security.\nSeparate research from the Ketman Project identified about 100 suspected North Korean IT workers operating under false identities across 53 crypto and Web3 projects. Investigators also traced suspected groups across 11 code repositories where projects had already merged 62 pull requests before the activity was detected.\nNorth Korea stole more than $2 billion in crypto in 2025\nThe development of AI-assisted attack infrastructure comes after North Korean hacking groups stole an estimated $2.02 billion in cryptocurrency during 2025, according to Chainalysis data previously reported by crypto.news.\nMost of the year’s losses came from the February 2025 attack against Bybit, where more than 400,000 Ether and staked Ether worth about $1.5 billion were stolen. The FBI attributed the breach to North Korea and identified the actors responsible under its TraderTraitor designation.\nBybit has since taken the dispute into a U.S. federal court. On Aug. 8, the exchange sued the Democratic People’s Republic of Korea, its Reconnaissance General Bureau intelligence agency and the Lazarus Group in the U.S. District Court for the District of Columbia.\nThe exchange also obtained a preliminary injunction covering certain stolen assets held by unidentified defendants. The order prevents the identified assets from being transferred, sold or otherwise disposed of while the civil case proceeds, although it does not constitute a final ruling over ownership or liability.\nBlockchain tracing became increasingly difficult after the Bybit theft as the attackers converted assets into Bitcoin and dispersed funds across thousands of wallets. By April 2025, Bybit CEO Ben Zhou said 27.6% of the stolen funds could no longer be tracked.\nResearchers have also warned that AI could reduce the time attackers need to identify weaknesses in software. NEAR Protocol co-founder Illia Polosukhin has said AI is increasing hackers’ ability to locate vulnerabilities faster than conventional security processes can patch them.\nThe $100 million Coldcard Bitcoin hardware wallet exploit has also been suspected of originating from an obscure vulnerability uncovered with AI. Separately, North Korean operators continue to use phishing, fake remote workers and compromised online identities, while the latest Genians research shows Kimsuky preparing local AI models for malware development, data analysis and attack automation.\n\n\n\n\n\n                Read more:\n            \n\n                Ripple mints $10M RLUSD as XRP whales add 380M","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"-1","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"}}}