Microsoft: 3 North Korean hacker groups have fully integrated AI into attack workflows

According to 深潮 TechFlow, Oct. 30, Yonhap News Agency reported that Microsoft Threat Intelligence analyzed the AI adoption levels of 8 North Korean hacker groups. 3 have entered the "operationalization" stage, the highest of a 4-level classification. Another 4 groups are in the "acceleration" stage, and 1 is in the "expansion" stage. One group generated more than 100 customized PDF lure documents targeting South Korean users from August to September, with some capable of mass-producing dozens within minutes.

According to South Korean cybersecurity firm Genians, North Korean hacker group Kimsuky set up a local large language model (LLM) and RAG environment in August this year and left extensive usage records of the AI code editor Cursor. Microsoft's report also noted that these groups may have used the agentic AI penetration testing tool ARTEX. Microsoft also assessed that these groups have not yet reached the stage of fully autonomous attacks. The actual impact of AI on attack success rates and costs remains inconclusive.

According to analysis by U.S. cybersecurity firm TRM Labs, approximately $6.36 billion in funds across 10 Binance blockchain wallets were stolen in about 20 minutes, and the firm believes North Korean group TraderTraitor was behind the attack. It has not yet been confirmed whether this attack used AI.

Source: 深潮 TechFlow