Dozens in Minutes with AI... North Korean Hacking Groups Target South Korea

North Korean hacking groups are reportedly increasing the speed and scale of their cyberattacks, such as mass-producing phishing documents targeting South Korean users by leveraging artificial intelligence (AI).

The scope of AI utilization is also expanding from fake recruitment and identity disguises to malware development and software supply chain attacks.

These findings on North Korean hacking groups' use of AI were included in a report released by Microsoft (MS) Threat Intelligence on the 29th (local time).


As a result of analyzing the AI adoption levels of eight North Korean hacking groups, MS evaluated that three of them have reached the "operational integration" stage, where AI is integrated into routine attack operations.

This is the highest level among a total of four stages.

The remaining four groups were classified into the "accelerating" stage, where AI utilization is rapidly spreading, and one group into the "expanding" stage, which has introduced AI to some tasks.

In particular, AI was found to have been utilized in phishing attacks targeting South Korean users as well.

One North Korean hacking group created more than 100 customized PDF lure documents tailored to each target from August to September of this year.

Circumstances were also confirmed where dozens of documents were produced within a matter of minutes.

Fake recruitment and identity disguises utilizing AI are also spreading.

There was also a case where fake job offers were made to workers in the AI, blockchain, and cybersecurity industries utilizing three front companies from June 8 to 12 of this year.

AI was also mobilized for malware development.

MS analyzed that North Korean hacking groups likely received support for code generation, bug fixing, and the development of detection-evasion technologies by utilizing AI coding tools such as Cursor.

Agentic AI-based hacking tools were also utilized in actual attacks.

MS revealed that "Onyx Sleet" (domestic name Andariel) and "Pearl Sleet," organizations affiliated with North Korea's Reconnaissance General Bureau, have been utilizing "ARTEX," an open-source AI penetration testing framework, in their operations since late October.

MS evaluated that while North Korean hacking groups are utilizing AI to increase the speed and efficiency of existing attacks, they have not yet reached the stage of fully autonomous attacks.

It recommended that companies strengthen identity verification for job applicants, phishing response, and malware detection systems.

(Photo provided by MS Threat Intelligence, Yonhap News)
※ Please note: This article was translated by AI and may contain errors.