North Korea-linked threat actor Kimsuky has established local artificial intelligence environments to automate cyberattacks against cryptocurrency, investment, and fintech firms, according to new research from South Korean cybersecurity company Genians.
The group deployed offline, open-source large language model setups using platforms like Ollama, GPT4All, and Msty. Operating AI tools locally allows the hackers to process data, write malware, and refine attack scripts without sending sensitive operational details to external cloud providers. The infrastructure incorporates retrieval-augmented generation (RAG), the Cursor AI coding assistant, and speech-to-text libraries to embed language models directly into custom software tools.
Genians reported that Kimsuky is actively preparing to integrate AI into operational capabilities rather than running isolated experiments. Beyond coding support, the group has used generative AI to create highly polished, professional phishing documents mimicking legitimate Korean AI investment platforms.
This technological pivot follows an aggressive campaign by North Korea-linked cyber actors targeting the digital asset industry. According to Chainalysis, North Korean hackers stole an estimated $2.02 billion in cryptocurrency in 2025, largely anchored by the $1.5 billion exploit of crypto exchange Bybit in February 2025. Groups like BlueNoroff have also combined AI-generated avatars with social engineering to execute fake Zoom meetings and deploy wallet-scanning malware.
The deployment of local AI models marks an evolution in North Korean cyber tactics, enabling threat actors to accelerate vulnerability discovery, improve social engineering quality, and scale attack automation against global Web3 financial infrastructure.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
