North Korea’s Hackers Weaponize AI
- In their ongoing pursuit of foreign currency, North Korean cybercriminals are increasingly utilizing artificial intelligence as a potent new tool.
- South Korea's National Intelligence Service (NIS) has reported that North Korean hackers are employing generative AI to bolster their hacking schemes.
- ChatGPT, DeepSeek, and Google's Gemini are among the AI models being exploited by North Korean hackers for fraudulent activities.
North Korean Hackers Weaponizing AI for Cyberattacks
Table of Contents
- North Korean Hackers Weaponizing AI for Cyberattacks
- North Korean Hackers Weaponizing AI for Cyberattacks: Your Questions Answered
Published:
In their ongoing pursuit of foreign currency, North Korean cybercriminals are increasingly utilizing artificial intelligence as a potent new tool. Experts warn that thes AI-driven activities may be exceptionally challenging to counteract.
Generative AI Exploitation
South Korea‘s National Intelligence Service (NIS) has reported that North Korean hackers are employing generative AI to bolster their hacking schemes. This includes identifying potential targets and streamlining digital assaults.
AI Platforms Targeted
ChatGPT, DeepSeek, and Google’s Gemini are among the AI models being exploited by North Korean hackers for fraudulent activities.
Despite efforts by major US-based AI companies like OpenAI and Google to shut down accounts linked to Pyongyang’s state-backed hackers, cybersecurity experts believe these measures are unlikely to stop the increasing trend of cyberattacks.
Since late January, OpenAI, the creator of chatgpt, and Google have announced measures to close accounts suspected of being tied to North Korean operatives. they have also revealed how their platforms have been manipulated for illicit purposes. However, industry insiders caution that the regime’s hackers and scammers can easily bypass restrictions using virtual private networks, shell companies, and brokers.
Threat actors will use the cheapest and most efficient tool to get the job done.
Rafe Pilling, director of threat intelligence at the US-based cybersecurity firm Secureworks
According to rafe pilling, “Threat actors will use the cheapest and most efficient tool to get the job done.”
Many cybercriminals prefer online services that are free to sign up for or can be paid for via cryptocurrency. This would likely be true for North Korean IT workers as well.
Rafe Pilling, director of threat intelligence at the US-based cybersecurity firm Secureworks
Pilling also noted, ”Many cybercriminals prefer online services that are free to sign up for or can be paid for via cryptocurrency. This would likely be true for North Korean IT workers as well.”
Option AI Platforms
North Korean operatives are not limited to US-based AI tools like ChatGPT or google Gemini. Analysts highlight the increasing availability of cheaper, more accessible generative AI platforms worldwide, some of which may have fewer safeguards against misuse.
Increased Hacking Activity
Seoul’s spy agency has warned that hacking against South Korea could increase due to Seoul’s growing strategic relations with partners,such as intensified Korea-US-Japan cooperation and increased North Korean threats.
North Korean Hackers Weaponizing AI for Cyberattacks: Your Questions Answered
Published: March 9, 2025
North Korean cybercriminals are increasingly leveraging the power of artificial intelligence (AI) in their pursuit of foreign currency.Experts suggest that these AI-driven activities present a significant challenge too effective countermeasures.Here’s what you need to know about this growing threat.
Generative AI Exploitation: Understanding the Tactics
How are North Korean hackers using generative AI in cyberattacks?
South Korea’s National Intelligence Service (NIS) reports that North Korean hackers are actively utilizing generative AI to enhance their hacking operations. This includes:
- Identifying potential targets: AI assists in pinpointing vulnerabilities and potential victims.
- Streamlining digital assaults: AI helps automate and optimize the execution of cyberattacks, making them more efficient.
Which AI platforms are being targeted or exploited by North Korean hackers?
The following AI platforms have been identified as targets for exploitation by North Korean hackers:
- ChatGPT
- DeepSeek
- Google’s Gemini
What measures have been taken to counter North Korean hackers’ use of AI, and how effective are they?
Major US-based AI companies like OpenAI and Google have taken steps to shut down accounts linked to Pyongyang’s state-backed hackers. However, cybersecurity experts believe these measures are unlikely to completely stop the increasing trend of cyberattacks becuase:
- circumvention Techniques: Hackers can easily bypass restrictions using virtual private networks (vpns), shell companies, and brokers.
- Availability of Alternative Platforms: Cheaper, more accessible generative AI platforms exist worldwide that might have fewer safeguards against misuse.
The Economics and Efficiency of AI in Cybercrime
Why are North Korean hackers turning to AI?
Rafe Pilling, director of threat intelligence at Secureworks, notes, “Threat actors will use the cheapest and most efficient tool to get the job done.” AI provides cost-effective and efficient means for:
- Target Identification
- Attack Automation
- Bypassing Security Measures
How does cryptocurrency play a role in North Korean cybercrime involving AI?
According to Rafe Pilling, “Many cybercriminals prefer online services that are free to sign up for or can be paid for via cryptocurrency. This would likely be true for North Korean IT workers as well.” Cryptocurrency:
- Provides Anonymity: Cryptocurrency transactions are tough to trace, making it ideal for illicit activities.
- Facilitates Payments: It allows for easy payment for AI tools and services, even those with restrictions.
Alternative AI Platforms and Future Threats
Are north Korean hacking operations limited to US-based AI platforms?
No, North Korean operatives are not limited to US-based AI tools like ChatGPT or Google Gemini. Analysts highlight the increasing availability of cheaper, more accessible generative AI platforms worldwide, some of which may have fewer safeguards against misuse.
How might increased hacking activity impact South Korea?
Seoul’s spy agency has warned that hacking against South Korea could increase due to Seoul’s growing strategic relations with partners, such as intensified Korea-US-Japan cooperation and increased North Korean threats.
Summary of AI Platform Exploitation by North Korean Hackers
| AI Platform | Likely use in Cyberattacks | Countermeasures | Limitations |
|---|---|---|---|
| ChatGPT | Identifying vulnerabilities,crafting phishing emails | Account shutdowns by OpenAI | Circumvention via VPNs,alternative platforms |
| DeepSeek | Automating reconnaissance,target profiling | Limited direct countermeasures | Accessibility from various regions |
| Google’s Gemini | developing malicious code,generating disinformation | Account shutdowns by Google | Circumvention via proxies,alternative platforms |
| Alternative AI Platforms | All hacking activities,fewer safeguards | Limited to no countermeasures | Accessibility and affordability |