Dozens in Minutes with AI… North Korean Hacking Groups Target South Korea

North Korean hacking groups are reportedly scaling up the speed and scope of their cyberattacks, such as using artificial intelligence (AI) to mass-produce phishing documents targeting South Korean users.

The scope of AI utilization is also expanding from fake recruitment and identity spoofing to malware development and software supply chain attacks.

These findings on how North Korean hacking groups leverage AI were included in a report released by Microsoft (MS) Threat Intelligence on the 29th (local time).


Analyzing the AI adoption levels of eight North Korean hacking groups, MS evaluated that three of them have reached the "operationalized" stage, where AI is integrated into routine attack operations.

This is the highest level among a total of four stages.

The remaining four groups were classified in the "accelerating" stage, where AI use is rapidly spreading, and one group in the "expanding" stage, having introduced AI to some tasks.

In particular, AI was also found to be utilized in phishing attacks targeting South Korean users.

Between August and September of this year, one North Korean hacking group generated more than 100 customized PDF lure documents tailored to individual targets.

Circumstances were also confirmed where dozens of documents were produced within just minutes.

Fake recruitment and identity spoofing utilizing AI are also spreading.

There was a case between June 8 and 12 of this year where three front companies were used to make fake job offers to workers in the AI, blockchain, and cybersecurity industries.

AI was also mobilized for malware development.

MS analyzed that North Korean hacking groups may have utilized AI coding tools such as Cursor to receive support for code generation, debugging, and the development of detection-evasion techniques.

Agentic AI-based hacking tools were also deployed in actual attacks.

MS stated that "Onyx Sleet" (domestically known as Andariel) and "Pearl Sleet," organizations under North Korea's Reconnaissance General Bureau, have been using ARTEX, an open-source AI penetration testing framework, in their operations since late October.

MS evaluated that while North Korean hacking groups are leveraging AI to increase the speed and efficiency of existing attacks, they have not yet reached the stage of fully autonomous attacks.

It recommended that companies strengthen their identity verification for job applicants, phishing response, and malware detection systems.

(Photo provided by MS Threat Intelligence, Yonhap News)
※ Please note: This article was translated by AI and may contain errors.