Microsoft issues a warning: North Korean hackers employ AI-Powered cyberespionage

Microsoft has disclosed that state-sponsored cyber actors linked to North Korea are harnessing artificial intelligence (AI) to enhance their operations.

The tech giant’s latest report on East Asia hacking groups highlights the emergence of AI-powered tools in the arsenal of groups like Emerald Sleet (aka Kimusky or TA427), which employs AI-driven spear-phishing tactics targeting Korean Peninsula experts.

These actors utilize AI for various tasks, including researching vulnerabilities, conducting reconnaissance, troubleshooting technical issues, and drafting spear-phishing content.

Collaborating with OpenAI, Microsoft has taken action against accounts associated with the threat actor. Meanwhile, a report from Proofpoint sheds light on Kimsuky’s tactics, which involve using personas from think tanks and NGOs to legitimize their emails.

The group has also adapted its tactics by abusing lax DMARC policies and incorporating web beacons for target profiling.

Additionally, North Korean hacking groups, such as Jade Sleet (also known as TraderTraitor and UNC4899), continue to engage in cryptocurrency heists and supply chain attacks, aiming to generate revenue for weapons programs and gather intelligence on the United States, South Korea, and Japan.

The Lazarus Group, which overlaps with Jade Sleet, employs sophisticated methods like Windows Phantom DLL Hijacking and macOS Transparency, Consent, and Control (TCC) database manipulation to deploy malware and evade detection.

Amidst these threats, the Konni group has launched a new campaign utilizing Windows shortcut (LNK) files to deliver malicious payloads, employing tactics to obfuscate command lines and bypass detection.

Credit: LinkedIn/ Microsoft