朝鲜黑客组织 Kimsuky将 AI 武器化，针对加密货币领域发动更隐蔽网络攻击

According to Bitcoin.com, cybersecurity company Genians Security Center released an analysis report stating that the North Korean Reconnaissance General Bureau-affiliated hacker group Kimsuky is building and testing an AI-centric cyberattack tool suite. Researchers discovered traces of the deployment of three local AI platforms, Ollama, GPT4All, and Msty, in their infrastructure, as well as AI development framework components such as Microsoft Semantic Kernel and LLaMaSharp, indicating that the organization is systematically developing dedicated AI attack tools rather than just making temporary attempts. Since early 2026, Kimsuky has used high-quality documents created by generative AI for spear-phishing attacks targeting the virtual assets, financial investment, and game development sectors; AI-generated professional documents have significantly reduced the effectiveness of traditional phishing email identification. The attack vector consists of ZIP archives disguised as legitimate documents, containing malicious LNK files that can silently execute PowerShell commands in the background after being triggered.