ChainCatcher report, according to Yonhap News, Microsoft Threat Intelligence’s report released on the 29th reveals that North Korean hacker groups are leveraging artificial intelligence to accelerate cyberattacks against South Korean users, expanding from customized phishing documents, fake job postings, and identity impersonation to malicious code development and software supply chain attacks. Microsoft assessed the AI adoption levels of eight North Korea-linked hacker groups: three have reached the highest “Operationalized” stage at Level 4, integrating AI into their daily attack workflows; four are in the “Accelerating” stage, and one is in the “Expanding” stage. The report notes that during August–September this year, organized groups generated over 100 customized PDF bait documents targeting different victims, with instances of dozens being produced within minutes. Between June 8–12, attackers impersonated three fake companies to send fraudulent job offers to professionals in AI, blockchain, and cybersecurity. Additionally, Microsoft analysis suggests North Korean hackers may be using AI programming tools such as Cursor to assist with code generation, debugging, and evasion of detection. Since late October, the Reconnaissance General Bureau-affiliated groups “Onyx Sleet” (known in South Korea as Andariel) and “Pearl Sleet” have actively employed the open-source AI penetration testing framework ARTEX in real-world operations. Microsoft believes that while these groups have significantly improved their attack speed and efficiency through AI, they have not yet reached full autonomy in attacks, and recommends that organizations strengthen verification of job applicants, phishing defenses, and malicious code detection.
Microsoft Report: North Korean Hackers Use AI to Generate Phishing Documents and Carry Out Malicious Code Attacks
ChaincatcherShare
Summary
Microsoft reported that North Korean hackers are using AI to generate phishing documents and deploy malicious code, targeting South Korean entities. Eight groups were assessed, with three at the highest stage of AI integration. Over 100 PDF lures were created within two months, and fake job offers targeted professionals in AI and crypto markets. Risk-on assets remain vulnerable as attackers utilize tools such as Cursor and ARTEX. Microsoft urged organizations to strengthen identity verification and malware detection.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.