ChainThink reports that on August 10, according to Yonhap News, cybersecurity firm Genians revealed that Kim Soguk, a hacking group under North Korea’s Reconnaissance General Bureau, has developed an independent local large language model (LLM) environment and a retrieval-augmented generation (RAG) system.
The organization uses local LLM management tools such as Ollama, GPT4All, and Msty, along with the AI code editor Cursor, to automate intelligence extraction and attack workflows.
In terms of attack methods, Kim Suk-ki has shifted to using generative AI to create highly realistic virtual assets and financial documents for targeted spear-phishing attacks, aiming to steal sensitive data such as cryptocurrency wallet information, Gmail accounts, and website registration records.
Moon Jong-hyun, Head of the Genians Security Center, stated that as AI technology advances, social engineering attacks will continue to become more sophisticated, and recommended that enterprises deploy EDR threat hunting systems centered on behavioral detection to address this threat.