Kimsuky hacking group used AI coding agent to create malware decoys, report says
Yonhap: North Korea-linked Kimsuky hacking group used AI coding agent opencode to create malware decoys.
South Korean security firm Genians Inc. said in its latest cyber threat intelligence report that the assessment was based on an analysis of 13 malicious files collected last month. The hacking group distributed emails with compressed attachments containing documents with names such as 'insurance bills' and 'policy fund notice'; opening the files activated malware, according to the report.
The files carried traces of an open-source AI coding agent called opencode. In some PDFs, the metadata fields 'creator' and 'producer' were both set to 'opencode.' Genians said such values were not typically generated by standard document software, suggesting the files were created by an AI agent through programming rather than manually.
Genians said this was the first time it had found evidence of Kimsuky using an AI coding agent in malicious attacks. Earlier, the company detected signs that the hacking group had used large language models to make decoys and plan malicious attacks.