According to Microsoft Threat Intelligence and PANews, North Korean hacker groups are massively introducing generative AI to automate attacks, create fake documents and penetrate corporate networks.
AI at all stages of attacks
Of the eight groups from the DPRK monitored by Microsoft, three have reached the highest level of maturity (Operationalized) on the AI implementation scale.
The use of generative models allows hackers to create dozens of personalized bait PDF files in minutes. In August and September alone, more than 100 unique phishing documents aimed at employees of IT, crypto and defense companies were recorded.
How hackers use AI
Personalized PDF lures: AI removes stylistic errors and adapts the text to the victim (under the guise of test tasks, invitations or offers).
Writing and obfuscation of code: AI assistants are used to debug and confuse malicious code, which helps to bypass antivirus and EDR systems.
Social engineering: Creation of fake profiles of recruiters and candidates generated by AI photos for implementation in the staff of technological and Web3 companies.
Main risks and protection
For the crypto industry and blockchain projects, this poses a direct threat of attack on software supply chains and theft of digital assets through personnel.
Expert assessment: AI does not yet determine goals on its own, but routine automation has accelerated the preparation of attacks at times.
Main protection measures:
1. Personnel audit: Thorough verification of the profiles of remote specialists when hiring.
2. Behavioral analysis: Use of EDR/XDR systems to detect anomalies, not just known signatures.
3. Isolation: Opening documents from external sources only in sandboxes.
4. Hardware 2FA: Use of FIDO2 keys to protect against session interception.