North Korean hacking groups have been stepping up the speed and scale of their cyberattacks by utilizing artificial intelligence (AI) to mass-produce phishing documents targeting South Korean users, according to an analysis.
The scope of AI utilization is also expanding from fake recruitment and identity spoofing to malware development and software supply chain attacks.
A report released by Microsoft (MS) Threat Intelligence on the 29th (local time) details the use of AI by North Korean hacking groups.
Analyzing the AI adoption levels of eight North Korean hacking groups, MS evaluated that three of them have reached the "operational integration" stage, where AI is integrated into routine attack operations.
This is the highest level out of four total stages.
The remaining four groups were classified in the "acceleration" stage, where AI utilization is spreading rapidly, and one group was classified in the "expansion" stage, having introduced AI to some tasks.
In particular, AI was found to have been used in phishing attacks targeting South Korean users.
Between August and September of this year, one North Korean hacking group generated more than 100 customized PDF lure documents tailored to individual targets.
Circumstances were also confirmed where dozens of documents were produced in just a few minutes using AI.
Fake recruitment and identity spoofing using AI are also spreading.
There was also a case where fake job offers were made to workers in the AI, blockchain, and cybersecurity industries using three front companies from June 8 to 12 of this year.
AI was also mobilized for malware development.
MS analyzed that North Korean hacking groups likely received assistance with code generation, error correction, and the development of detection evasion technologies by utilizing AI coding tools such as Cursor.
Agentic AI-based hacking tools were also used in actual attacks.
MS stated that the North Korean Reconnaissance General Bureau-affiliated groups Onyx Slit (domestic name Andariel) and Pearl Slit have been utilizing ARTEX, an open-source AI penetration testing framework, in their operations since late October.
MS evaluated that while North Korean hacking groups are using AI to increase the speed and efficiency of existing attacks, they have not yet reached the stage of fully autonomous attacks.
It recommended that companies strengthen identity verification for job applicants, phishing response, and malware detection systems.
(Photo provided by MS Threat Intelligence, Yonhap News)
※
Copying, redistribution, and unauthorized use in AI training are strictly prohibited.