Microsoft: North Korean hackers use AI to mass-generate phishing documents, fake job postings and malicious code development have been implemented

According to a report released by Microsoft Threat Intelligence on the 29th, North Korean hacker groups are using artificial intelligence to accelerate cyberattacks on South Korean users, expanding from customized phishing documents, fake recruitment, and identity disguise to malicious code development and software supply chain attacks. Microsoft assessed the AI adoption levels of eight North Korean-related hacker organizations: three have reached the highest "Operational Maturity" stage at level four, integrating AI into their daily attack processes; four are in the "Acceleration" stage, and one is in the "Expansion" stage.

The report states that organized groups customized and generated over 100 PDF bait documents targeting different objectives between August and September this year, with instances of producing dozens of documents in just a few minutes. From June 8 to 12 this year, there were also cases of using three disguised companies to initiate fake recruitment invitations to professionals in AI, blockchain, and cybersecurity. Additionally, Microsoft analyzed that North Korean hackers might use AI programming tools like Cursor to assist in code generation, debugging, and evading detection; the North Korean Reconnaissance General Bureau's "Onyx Sleet" (referred to as Andariel by South Korea) and "Pearl Sleet" have been using the open-source AI penetration testing framework ARTEX in real operations since late October. Microsoft believes that while these organizations have enhanced their attack speed and efficiency with AI, they have not yet entered a fully autonomous attack phase and recommends that companies strengthen identity verification for job applicants, phishing protection, and malicious code detection.