Rise of AI raises fears of North Korean hacking capabilities

Concerns are mounting that North Korean hackers are weaponizing AI's ability to autonomously identify security vulnerabilities to launch more sophisticated cyberattacks against South Korean government systems.

Kaspersky, a Moscow-based cybersecurity company, said Wednesday that it had uncovered signs that the North Korean hacking group Kimsuky "used a large language model [LLM] in their attempts to create new malware." The company’s researchers found "emoji-filled comments and grammatical mistakes embedded in the code of a malware strain known as HelloDoor," noting that these are cues suggesting that an LLM had assisted in the code-writing.

"North Korean hackers are exploiting AI technology on a full scale for their cyberattacks," the company said. 

Anthropic’s security-focused AI model, Mythos, alarmed the cybersecurity industry by demonstrating that it can autonomously detect security vulnerabilities and build a scenario for a cyberattack. While such technology can be used to reinforce security, it can also be weaponized. That possibility has prompted governments around the world to scramble for countermeasures.

"Kimsuky is advancing the precision of its attacks on two fronts: using AI-powered code generation tools and abusing legitimate software," said Lee Hyo-eun, a manager at Kaspersky Korea. “Tools widely used among enterprises are increasingly being repurposed as attack channels, behavior-based detection systems and regular threat intelligence updates are becoming more important than ever,” Lee said.

The information technology (IT) security firm said that AI usage would advance hackers’ attacks and accelerate the speed and sophistication of such operations.

Kimsuky appeared to be targeting Seoul's government certification infrastructure, according to the Russian IT firm. The researchers discovered that the Kimsuky’s AppleSeed malware is loaded with a function that collects directories of government public key infrastructure, or GPKI.

The GPKI is a certification system for South Korean state agencies and employees.

“It means that the hackers set state officials as targets,” an official from another security firm said. “If those certificates are leaked, hackers could impersonate government officials and gain access to internal state networks.”

Kaspersky warned that such attacks could evolve from ordinary data theft into threats against national infrastructure security.

“Threat actors associated with the People’s Republic of China and the Democratic People's Republic of Korea have also demonstrated significant interest in capitalizing on AI for vulnerability discovery,” Google Threat Intelligence Group said in a report released Tuesday, referring to China and North Korea by their official names.

“We have observed [North Korean hacking group] APT45 sending thousands of repetitive prompts that recursively analyze different [common vulnerabilities and exposures] and validate [proof of concept] exploits,” Google’s report said. The pattern is what appeared to be efforts to automate vulnerability analysis and attack-code testing.

Industry sources say the threat from AI-powered cyberattacks could far eclipse the dangers associated with human-coded hacking attempts.

“[The hackers] can utilize AI to increase the frequency and effectiveness of zero-day attacks, which have no cure nor defense as they exploit previously undiscovered software vulnerabilities,” said Youm Heung-youl, an emeritus professor of information security at Soonchunhyang University.

“It is entirely possible that North Korea could either develop or gain access to security-specialized AI systems like Mythos,” Youm said. “[The South Korean] government needs to build national-level cybersecurity safeguards before these threats escalate further.”

“Organizations must assess their readiness against AI-driven attacks and research means of using AI in their own defense systems,” said Lee Seung-kyung, head of AI development at Korean cyber firm AhnLab.

“We now estimate a narrow three-to-five-month window for organizations to outpace the adversary before AI-driven exploits start to become the new norm,” wrote Lee Klarich, chief product and technology officer of U.S. cybersecurity firm Palo Alto Networks, in a blog post on Wednesday. “We’ve continued testing the latest frontier AI models, including Anthropic’s Mythos and Claude Opus 4.7 and OpenAI’s GPT-5.5-Cyber as part of the Trusted Access for Cyber program."

"Are we overstating the model capabilities?” he asked rhetorically. "With more testing, I can confidently say we weren’t. In fact, these models are likely even better at finding vulnerabilities than we initially realized."

Competition among big tech companies in AI security is also expected to intensify.

Microsoft said Tuesday that its new Microsoft Security multimodel agentic scanning harness, codenamed “Mdash,” helped researchers uncover 16 new vulnerabilities across the Windows networking and authentication stack.

“[Mdash gained] an industry-leading 88.45 percent score on the public CyberGym benchmark of 1,507 real-world vulnerabilities — the top score on the leaderboard, roughly five points ahead of the next entry,” the company wrote, adding its success ratio is ahead of Claude Mythos Preview’s 83.1 percent and OpenAI’s 81.8 percent.

Microsoft said Mdash outperformed competing AI models on the CyberGym benchmark, which measures how effectively systems can detect real-world software vulnerabilities.

The focus of AI security competition could shift from raw model performance to stronger control and governance systems, according to the industry observers.

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.

BY SEO JI-WON, LEE SOO-JUNG [[email protected]]