[South Korean Media: North Korean Hacking Groups Have Fully Integrated AI into Cyberattack Processes, Customized Phishing Documents Can Be Mass-Generated in Minutes] BlockBeats reported on October 30th, citing Yonhap News Agency, that recent analysis by Microsoft's threat intelligence department revealed that among the eight North Korean hacking groups assessed, three have reached the highest application stage of integrating AI into their daily attack operations, while four others are in the stage of rapidly expanding AI applications. One North Korean hacking group generated over 100 customized PDF bait documents targeting South Korean users between August and September of this year, sometimes producing dozens within minutes. AI can generate personalized phishing materials based on the target's profession, interests, and work environment, improving attack preparation efficiency. The report also points out that North Korean hacking groups are expanding AI applications to information analysis, malware development, and attack automation. South Korean cybersecurity company Genians previously discovered that the North Korean hacking group Kimsuky appeared to have built a local Large Language Model (LLM) and Retrieval Augmentation (RAG) environment, leaving traces of using AI programming tools such as Cursor. The Microsoft report also mentioned that the organization may have used AI programming tools to generate code, fix bugs, and develop detection evasion techniques, and had previously used the AI-based penetration testing tool ARTEX in its operations. Meanwhile, the report cited an analysis by TRM Labs, suggesting that the North Korean hacking group TraderTraitor is believed to be behind the recent attack on Binance. The incident involved 10 Binance blockchain wallets, with approximately $6.36 billion in assets stolen in about 20 minutes. TRM Labs suggested the attack may have involved the hot wallet transaction signature system used for processing customer withdrawals; Binance stated that attackers may have gained access to the internal environment by compromising the laptops of development and operations engineers. However, there is currently no evidence to confirm that AI was used in this Binance attack. Microsoft also pointed out that the North Korean hacking group has not yet reached the stage of fully autonomous attacks. The report emphasizes that while AI improves attack preparation and execution efficiency, its actual impact on attack success rate and cost remains to be verified. [Original Link]