Microsoft: North Korean hacking groups use AI to mass-produce phishing files targeting users; over 100 decoy documents discovered

According to TechFlow, on October 30, citing Yonhap News Agency, Microsoft Threat Intelligence published a report yesterday stating that North Korean hacking groups are expanding the use of artificial intelligence (AI) in cyberattacks, involving phishing attacks, identity impersonation, malicious software development, and software supply chain attacks. Microsoft analyzed 8 North Korean hacking groups, of which 3 have integrated AI into their routine attack activities, reaching the highest stage of AI adoption.

The report noted that from August to September this year, one group used AI to create more than 100 customized PDF phishing decoy documents targeting South Korean users, with dozens generated within minutes in some cases. In addition, North Korean hackers have also used AI to carry out fake job postings and identity impersonation, and may leverage AI coding tools such as Cursor to assist malicious software development. Microsoft also found that Onyx Sleet and Pearl Sleet, affiliated with North Korea's Reconnaissance General Bureau, have been using the open-source AI penetration testing framework ARTEX in operations since late October. Microsoft noted that the groups have not yet reached the stage of fully autonomous attacks.

Source: TechFlow