North Korean hackers use local AI to automate attacks on crypto firms

North Korea-linked hacking group Kimsuky has built three local AI environments as part of preparations for cyberattacks targeting cryptocurrency and financial companies, according to new cybersecurity research. Summary Kimsuky has built three local AI environments using Ollama, GPT4All and Msty. The North Korea-linked group is using AI for malware development, data analysis and attack automation. Kimsuky has produced AI-generated phishing material targeting crypto, investment and fintech firms. North Korean hackers stole an estimated $2.02 billion in cryptocurrency during 2025. Genians, a South Korean cybersecurity firm, said in a report released Monday that it found evidence of Kimsuky operating local large language model environments through Ollama, GPT4All and Msty, giving the group access to AI tools that can run without relying on external cloud services. Kimsuky has built local AI systems for cyberattacks Running models locally allows operators to make queries without sending potentially sensitive attack information to third-party AI providers. According to the research, the environments also support retrieval-augmented generation, which can connect an AI model with additiona...