North Korean hacking groups are reportedly increasing the speed and scale of their cyber attacks by utilizing artificial intelligence (AI) to mass-produce phishing documents targeting South Korean users.

The scope of AI utilization is also expanding from fake recruitment and identity disguises to malware development and software supply chain attacks.

A report released by Microsoft (MS) Threat Intelligence on October 29 (local time) details the use of AI by North Korean hacking organizations.


Analyzing the AI adoption levels of eight North Korean hacking groups, MS evaluated that three of them have reached the "operational integration" stage, where AI is integrated into routine attack operations.

This is the highest level among a total of four stages.

The remaining four groups were classified in the "accelerating" stage, where AI adoption is spreading rapidly, and one group in the "expanding" stage, having introduced AI to some tasks.

In particular, AI was also found to be used in phishing attacks targeting South Korean users.

One North Korean hacking group generated more than 100 customized PDF lure documents for each target between August and September of this year.

Circumstances were also confirmed where dozens of documents were produced in a matter of minutes.

Fake recruitment and identity disguises utilizing AI are also spreading.

There was also a case where fake job offers were made to workers in the AI, blockchain, and cybersecurity industries using three front companies from June 8 to 12 this year.

AI was also mobilized for malware development.

MS analyzed that North Korean hacking groups likely received support from AI coding tools such as Cursor for code generation, bug fixing, and the development of detection evasion techniques.

Agentic AI-based hacking tools were also utilized in actual attacks.

MS stated that organizations under North Korea's Reconnaissance General Bureau, namely "Onyx Slit" (known domestically as Andariel) and "Pearl Slit", have been utilizing ARTEX, an open-source AI penetration testing framework, in their operations since late October.

MS evaluated that while North Korean hacking groups are using AI to increase the speed and efficiency of existing attacks, they have not yet reached the stage of fully autonomous attacks.

It recommended that companies strengthen identity verification for job applicants, phishing response, and malware detection systems.

(Photo provided by MS Threat Intelligence, Yonhap News)