North Korean Hackers Kimsuky Use Local AI Tools to Target Crypto Firms
Genians analysts warn that the Kimsuky group is deploying local LLM environments like Ollama and GPT4All for attacks on cryptocurrency and financial companies.
The North Korea-linked hacking group Kimsuky is using locally run AI systems to conduct cyberattacks against cryptocurrency and financial firms, according to research by cybersecurity firm Genians.
Analysts identified local large language model (LLM) setups built with Ollama, GPT4All, and Msty. These tools operate offline and incorporate Retrieval-Augmented Generation, allowing queries without data being sent to cloud services.
Further infrastructure includes libraries and frameworks for embedding language models into proprietary software, the AI coding assistant Cursor, and speech recognition tools.
Source: ForkLog