North Korean hacking groups integrate AI into routine cyberattacks

The shift to operational AI

Microsoft Threat Intelligence recently released a report detailing how North Korean hacking groups are adopting artificial intelligence. The analysis looked at eight different groups and found that three of them have reached the 'operationalized' stage of AI use. This means that AI is no longer just an experimental tool but is now integrated into their routine attack operations.

The report categorizes AI adoption into four distinct levels. While three groups are fully operational, four other groups are in the 'accelerating' stage where AI use is spreading rapidly. One remaining group is in the 'expanding' stage, having introduced AI to specific tasks rather than full operations.

This progression shows a systematic move toward automating cyber warfare. By moving from manual processes to AI-assisted workflows, these groups can execute attacks with significantly higher speed and efficiency. As reported by SBS News, these groups are leveraging these capabilities to target specific regions and industries.

Automating phishing and lures

One of the most visible impacts of this AI adoption is seen in phishing attacks targeting South Korean users. Between August and September of this year, a North Korean hacking group generated more than 100 customized PDF lure documents. These documents were specifically tailored to individual targets rather than being sent as generic spam.

The speed of this production is a primary concern for security professionals. The report confirmed instances where dozens of these documents were produced within just minutes. This level of rapid, personalized content generation allows hackers to cast a wider net while maintaining a high degree of relevance for each victim.

Beyond simple emails, these groups are using AI for fake recruitment and identity spoofing. Between June 8 and 12 of this year, three front companies used AI to create fake job offers. These offers targeted workers specifically in the AI, blockchain, and cybersecurity industries, seeking to exploit the high demand in those fields.

Malware and code development

North Korean hackers are also moving into the technical side of software development by using AI for malware creation. Microsoft analyzed that these groups may be utilizing AI coding tools, such as Cursor, to support their development cycles. These tools help the hackers with code generation and debugging during the creation of malicious software.

A critical part of this process involves developing techniques to evade detection systems. By using AI to assist in the coding process, the hackers can potentially create more sophisticated malware that is harder for traditional security software to identify. This allows them to maintain persistence on a target's network for longer periods.

Furthermore, the report identified the use of 'agentic' AI-based hacking tools in actual attacks. These are systems capable of performing tasks with a degree of autonomy. While the report notes that these groups have not yet reached a stage of fully autonomous attacks, the use of agentic tools represents a significant step forward in their technical capabilities.

Frameworks and specific groups

The report highlights specific organizations under North Korea's Reconnaissance General Bureau that are leading these efforts. These include the groups known as 'Onyx Sleet' (also known as Andariel) and 'Pearl Sleet.' These organizations have been actively using AI to bolster their cyber operations since late October.

Specifically, these groups have been using ARTEX, which is an open-source AI penetration testing framework. Penetration testing is a method where security professionals (or in this case, hackers) simulate an attack to find vulnerabilities. By using an open-source framework, these groups can leverage existing community-developed tools to enhance their own capabilities.

The use of open-source frameworks allows these hacking groups to stay current with the latest AI techniques without having to develop every tool from scratch. This synergy between open-source technology and state-sponsored hacking creates a more complex threat environment for organizations trying to defend their digital infrastructure.

Defense and future outlook

While the adoption of AI by North Korean groups is accelerating, Microsoft notes that they are not yet capable of fully autonomous attacks. The current trend is focused on increasing the speed and efficiency of existing methods rather than creating entirely new types of warfare. However, the rapid transition to the operational stage suggests that the window for manual defense is closing.

To counter these threats, Microsoft recommends that companies take specific actions to harden their defenses. Organizations should focus on strengthening identity verification processes, particularly for new job applicants who may be targeted by fake offers. They also need to improve their phishing response protocols to handle highly personalized lures.

Finally, the report suggests that companies must update their malware detection systems to account for AI-generated code. As hackers use AI to find ways around security, defenders must use more advanced methods to identify the subtle signs of these new attacks. Staying ahead of these groups requires a constant cycle of updating security protocols as AI capabilities evolve.