Kimsuky Hackers Weaponize AI-generated Crypto Documents In Spear-phishing Campaign

North Korea’s state-sponsored hacking group Kimsuky has been observed using AI-generated documents related to cryptocurrency and finance as lures in spear-phishing attacks, according to a new analysis from South Korean cybersecurity firm Genians, as reported by IT Chosun. The group reportedly employed a local large language model to analyze stolen documents and may be attempting to automate parts of its attack operations.

AI-powered phishing lures mimic legitimate business documents

The Genians analysis indicates that Kimsuky crafted phishing lures with AI-generated content, producing files that closely resemble authentic business documents. These files, which are polished to the level of real corporate communications, are designed to trick users into opening malicious attachments or clicking on malicious links. The use of cryptocurrency and finance topics is a deliberate tactic, as these subjects are likely to attract the attention of individuals and organizations dealing with digital assets.

Kimsuky, also known as APT43 or Emerald Sleet, has a long history of targeting government entities, think tanks, and individuals with access to sensitive geopolitical information. However, the shift toward AI-generated content marks a significant evolution in the group’s tradecraft, potentially enabling more convincing and scalable phishing campaigns.