Microsoft: Three North Korean hacker groups have fully integrated AI into their attack processes

According to reports from the Korean News Agency, Microsoft's Threat Intelligence team analyzed the AI application levels of 8 North Korean hacker groups. Among them, 3 have entered the "Operational Solidification" stage, which is the highest level in the 4-level classification. Additionally, 4 organizations are in the "Acceleration" stage, and 1 is in the "Expansion" stage. One organization generated over 100 customized PDF bait documents targeting South Korean users between August and September, with some documents being able to be produced in batches of dozens within minutes.

According to South Korean security company Genians, the North Korean hacker group Kimsuky has built a local large language model and RAG environment in August this year, leaving behind a significant amount of usage records for the AI code editor Cursor. The Microsoft report also mentioned that these organizations may have used the agent AI penetration testing tool ARTEX. Microsoft also assessed that these organizations have not yet reached the stage of fully autonomous attacks, and the actual impact of AI on the success rate and cost of attacks remains inconclusive.

According to analysis by the American security company TRM Labs, approximately $6.36 billion in funds from 10 Binance blockchain wallets were stolen in about 20 minutes, and the organization believes that North Korean group TraderTraitor is behind it. It has not yet been confirmed whether this attack utilized AI.