fullscreen

eFinder

eFinder

Home › North Korean State Activity › Article

North Korea’s hackers using AI for attacks, cybersecurity firm says

Al Jazeera · 🇶🇦 public Qatar · · 564 words · By John Power
North Korean State Activity Artificial Intelligence Risks Cybersecurity Threats
headphones Listen to the eFinder podcast briefing
Generate a natural audio summary of this story
Daily briefing

What to know about North Korean State Activity

North Korea’s hackers using AI for attacks, cybersecurity firm says Hacking group Kimsuky using AI-generated documents in spear-phishing attacks, South Korean cybersecurity firm says.

Claims checked 8
Techniques found 1
Topics 3

Coverage spectrum

Coverage gap: Low Left coverage
Left0%
Center100%
Right0%

3 sources compared across this story cluster. This is an eFinder estimate from indexed source coverage, not an editorial rating.

What happened

North Korea’s hackers using AI for attacks, cybersecurity firm says Hacking group Kimsuky using AI-generated documents in spear-phishing attacks, South Korean cybersecurity firm says.

Why it matters

North Korean state-backed hackers are using artificial intelligence to bolster cyberattacks against targets in the military, diplomacy and academia, a report has found.

Common ground

Kimsuky, a hacking group linked to North Korea’s intelligence services, has used AI-generated documents in a “pattern” of spear-phishing attacks since 2026, the South Korean cybersecurity firm Genians said in the report released on Monday.

Perspective signals

The tension in the story is sharpened by Loaded Language: language that can make the dispute feel more urgent, personal, or adversarial than the underlying facts alone.

open_in_new Read the original article: https://www.aljazeera.com/economy/2026/8/10/north-koreas-hackers-using-ai-for-at…

psychologyPropaganda Techniques Detected

eFinder identified 1 propaganda technique in this article. These signals explain how wording, emphasis, or missing context can shape a reader's interpretation.

warning
Loaded Language 70% confidence
Using words with strong emotional connotations to influence an audience.
Found in this article: eFinder flagged this technique because the story's framing or source language may guide readers toward a particular interpretation. Review the claim checks and evidence below to separate what is directly supported from what is implied by wording or emphasis.
Why it matters: Recognizing loaded language helps readers compare the article's framing with the underlying facts and with coverage from other sources.

fact_checkClaims Checked

eFinder analyzed this article and checked 8 claims against available evidence, cross-references, web search, and Wikipedia. Here is what the fact-checking layer found.

check_circle Corroborated 7
verified Verified By Reference 1
check_circle
Claim 1: “US researchers last week announced that they used AI to create viruses not found in nature for the first time”
CORROBORATED
Multiple sources report that US researchers used AI to create synthetic viruses not found in nature for the first time to fight antibiotic-resistant infections.
travel_explore
web search NEUTRAL — Researchers used artificial intelligence to create 16 new viruses capable of being reproduced in a lab to fight antibiotic resistant infections — but experts warn that the computer-made pathogens pose…
https://nypost.com/2026/08/07/health/ai-used-to-design-brand…
travel_explore
web search NEUTRAL — AI used to create viruses not found in nature for first time.The recent creation of AI-designed viruses highlights the potential of synthetic biology to address challenges like antibiotic resistance w…
https://btw.co/node/11846444/ai-designed-viruses/
travel_explore
web search NEUTRAL — AI creates first synthetic viruses.Breaking News: Scientists have used A.I. to create new viruses for the first time, raising hopes for medical advances while also raising the possibility that the tec…
https://www.linkedin.com/news/story/scientists-use-ai-to-des…
check_circle
Claim 2: “The attacks have used AI to automate the creation of malicious files disguised as legitimate documents, such as research reports and invitations”
CORROBORATED
Multiple sources confirm Kimsuky uses AI to automate the creation of malicious files disguised as research reports and invitations.
travel_explore
web search NEUTRAL — Kimsuky uses AI-made documents and ZIP lures to deliver AsyncRAT via hidden PowerShell, targeting victims with polished phishing files.
https://cybersecuritynews.com/kimsuky-uses-local-llms/
travel_explore
web search NEUTRAL — North Korea’s Kimsuky hacking group has been using AI-generated documents in spear-phishing attacks since 2026, automating the creation of malicious files disguised as legitimate research reports and …
https://undercodetesting.com/ai-agents-in-the-crosshairs-the…
travel_explore
web search NEUTRAL — Kimsuky has been making frequent use of such lures to create files that resemble professional letters or strategy reports, which carry malicious programs that hack the users' devices once downloaded.
https://www.koreajoongangdaily.com/korea/from-lures-to-local…
check_circle
Claim 3: “North Korean state-backed hackers are using artificial intelligence to bolster cyberattacks against targets in the military, diplomacy and academia”
CORROBORATED
The claim is explicitly reported by Al Jazeera and supported by threat intelligence reports from Trellix and Google regarding North Korean state actors using AI to enhance cyberattacks.
menu_book
wikipedia NEUTRAL — The demographics of North Korea are determined through national censuses and international estimates. The Central Bureau of Statistics of North Korea conducted the most recent census in 2008, where th…
https://en.wikipedia.org/wiki/Demographics_of_North_Korea
menu_book
wikipedia NEUTRAL — Japan–North Korea relations (Japanese: 日朝関係; Korean: 조일 관계) refers to international relations between Japan and North Korea. There are no diplomatic relations between Japan and North Korea and ties ar…
https://en.wikipedia.org/wiki/Japan–North_Korea_relations
menu_book
wikipedia NEUTRAL — Perplexity AI, Inc., or simply Perplexity, is an American privately held software company offering a web search engine that processes user queries and synthesizes responses. Perplexity products use la…
https://en.wikipedia.org/wiki/Perplexity_AI
+ 3 more evidence sources
verified
Claim 4: “In 2014, North Korea was identified by US authorities as the culprit in the hacking of Sony Pictures”
VERIFIED BY REFERENCE
The 2014 Sony Pictures hack and the attribution to North Korea by US authorities is a well-documented historical event confirmed by Wikipedia and other sources.
travel_explore
web search NEUTRAL — On November 24, 2014, the hacker group "Guardians of Peace" leaked confidential data from the film studio Sony Pictures Entertainment.
https://en.wikipedia.org/wiki/2014_Sony_Pictures_hack
travel_explore
web search NEUTRAL — Sony Pictures clings to what is good to nobody from the beginning. It's silly to expect in Sony Pictures to take off us. Sony Pictures makes only useless efforts.
https://www.engadget.com/2014-12-10-sony-pictures-hack-the-w…
travel_explore
web search NEUTRAL — 2014 Sony Pictures Hack refers to a cyberattack which compromised the Sony Pictures entertainment company's computer network in late November 2014, resulting in the leak of several unreleased films an…
https://knowyourmeme.com/memes/events/2014-sony-pictures-hac…
check_circle
Claim 5: “North Korean hackers stole cryptocurrency worth more than $2bn in the first nine months of 2025, according to a report by British blockchain analytics firm Elliptic”
CORROBORATED
Multiple sources report that North Korean hackers stole over $2 billion in cryptocurrency in 2025, citing researchers and government officials.
menu_book
wikipedia NEUTRAL — The 2017–2018 North Korea crisis was a period of heightened tension between North Korea and the United States. The crisis began early in 2017 when North Korea conducted a series of missile and nuclear…
https://en.wikipedia.org/wiki/2017–2018_North_Korea_crisis
menu_book
wikipedia NEUTRAL — North Korea, officially the Democratic People's Republic of Korea (DPRK), is a country in East Asia. It constitutes the northern half of the Korean Peninsula and borders China and Russia to the north …
https://en.wikipedia.org/wiki/North_Korea
menu_book
wikipedia NEUTRAL — People defect from North Korea for political, material, safety and personal reasons. Defectors flee to various countries, mainly South Korea. In South Korea, they are referred to by several terms, inc…
https://en.wikipedia.org/wiki/North_Korean_defectors
+ 3 more evidence sources
check_circle
Claim 6: “Kimsuky, a hacking group linked to North Korea’s intelligence services, has used AI-generated documents in a “pattern” of spear-phishing attacks since 2026”
CORROBORATED
Multiple sources, including Al Jazeera and specialized cybersecurity reports, confirm that Kimsuky has used AI-generated documents for spear-phishing since 2026.
menu_book
wikipedia NEUTRAL — An advanced persistent threat (APT) is a stealthy cybersecurity threat, typically manipulated by a state or state-sponsored group, which gains unauthorized access to a computer network and remains und…
https://en.wikipedia.org/wiki/Advanced_persistent_threat
menu_book
wikipedia NEUTRAL — South Korea has a relatively low crime rate compared to other industrialized countries.
https://en.wikipedia.org/wiki/Crime_in_South_Korea
menu_book
wikipedia NEUTRAL — Proton Mail is an end-to-end encrypted email hosting service. It was launched in 2014 by Andy Yen, Jason Stockman and Wei Sun. Proton Mail is headquartered in Geneva, Switzerland. It is owned by the n…
https://en.wikipedia.org/wiki/Proton_Mail
+ 3 more evidence sources
check_circle
Claim 7: “Kimsuky has used open-source tools such as Ollama, GPT-4All, and Msty to run large language models without an internet connection”
CORROBORATED
Three independent web search results specifically name Ollama, GPT-4All, and Msty as tools used by Kimsuky to run LLMs offline.
travel_explore
web search NEUTRAL — The core evidence is tools for running language models offline: Ollama, GPT4All and Msty, all found on infrastructure Genians linked to the group. The report says they were run or configured, not mere…
https://thehackernews.com/2026/08/kimsuky-builds-offline-ai-…
travel_explore
web search NEUTRAL — Understand how Kimsuky deploys offline LLMs (Ollama, GPT4All, Msty) and RAG to process stolen documents and generate convincing phishing lures without cloud exposure.GPT4All: An ecosystem for running …
https://undercodetesting.com/kimsukys-offline-ai-arsenal-whe…
travel_explore
web search NEUTRAL — Operation GitPower, a Kimsuky campaign, uses AI-generated lure documents and GitHub/GitLab-based C2 infrastructure to deliver malicious payloads.Observed indications that the Kimsuky group built and o…
https://www.genians.co.kr/en/blog/threat_intelligence/kimsuk…
check_circle
Claim 8: “the South Korean cybersecurity firm Genians said in the report released on Monday”
CORROBORATED
Multiple web search results confirm that the South Korean cybersecurity firm Genians released a report on a Monday detailing Kimsuky's AI activities.
travel_explore
web search NEUTRAL — Kimsuky, a hacking group linked to North Korea’s intelligence services, has used AI-generated documents in a “pattern” of spear-phishing attacks since 2026, the South Korean cybersecurity firm Genians…
https://www.aljazeera.com/economy/2026/8/10/north-koreas-hac…
travel_explore
web search NEUTRAL — ChainThink reported on Aug. 10, citing Yonhap News, that South Korean cybersecurity firm Genians has identified activity.
https://bingx.com/en/flash-news/post/genians-says-kimsuky-bu…
travel_explore
web search NEUTRAL — KEY TAKEAWAYSGenians found Kimsuky using AI for phishing, malware and data analysis.U.S. Treasury sanctioned Kimsuky in 2023 as a North Korean espionage group.Genians also found AI agent development f…
https://www.ksl.com/article/51607801/north-korean-hacking-gr…
info Disclaimer: This analysis is generated by AI and should be used as a starting point for critical thinking, not as definitive truth. Claims are verified against publicly available sources. Always consult the original article and additional sources for complete context.