A North Korean hacking group built large language model tools and collected software that could help automate ​cyberattacks, analyse stolen material and produce more convincing phishing ‌campaigns, a South Korean cybersecurity firm said on Monday.

The cybersecurity firm, Genians, said it found evidence that the North Korean-linked group Kimsuky ​had set up tools for running and managing AI ​models locally, including Ollama, GPT4All and Msty, alongside document ⁠search technology known as retrieval-augmented generation (RAG).

According to the ​company, the tools could allow operators to process documents without ​sending sensitive information to outside AI services.

Genians also found AI agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool, on infrastructure it ​linked to the campaign.

The findings suggest Kimsuky is moving ​beyond using generative AI to create phishing lures and is building capacity ‌to integrate existing AI models into malware development, data analysis and attack automation, Genians said in a report.

Genians also said it found finance and cryptocurrency-themed decoy documents that appeared to have ​been generated with ​AI.

The ⁠materials were designed to resemble legitimate investment reports and other workplace documents, it said.

The company’s findings ​could not be independently verified.

North Korea has ​for years ⁠used state-linked cyber units for espionage, financial theft and revenue generation, according to US and South Korean authorities, as well ⁠as cybersecurity ​experts.

The US Treasury in 2023 sanctioned Kimsuky as a North Korean government-controlled cyber-espionage group, saying it gathered intelligence in support ​of Pyongyang’s strategic objectives.