/images/ppid_59c68470-image-175790002558392591.webp)
What is the story about?
A suspected North Korean state-sponsored hacking group used ChatGPT to create a deepfake of a military ID document to attack a target in South Korea, according to cybersecurity researchers.
Attackers used the artificial intelligence tool to craft a fake draft of a South Korean military identification card to create a realistic-looking image meant to make a phishing attempt seem more credible, according to research published Sunday by Genians, a South Korean cybersecurity firm. Instead of including a real image, the email linked to malware capable of extracting data from recipients’ devices, according to Genians.
The group responsible for the attack, which researchers have dubbed Kimsuky, is a suspected North Korea-sponsored cyber-espionage unit previously linked to other spying efforts against South Korean targets. According to a 2020 advisory, the US Department of Homeland Security said Kimsuky “is most likely tasked by the North Korean regime with a global intelligence-gathering mission. "
Also Read | Urban Company IPO allotment expected on September 15: Steps to check status, listing date and other key details
The July findings by Genians are the latest example of suspected North Korean operatives deploying AI as part of their intelligence-gathering work. In August, Anthropic said it discovered North Korean hackers used the Claude Code tool to get hired and work remotely for US Fortune 500 tech companies. In that case, Claude helped them build elaborate fake identities, pass coding assessments, and deliver actual technical work once hired.
OpenAI representatives didn’t immediately respond to a request for comment outside normal hours. The company said in February it had banned suspected North Korean accounts that had used the service to create fraudulent résumés, cover letters and social media posts to try recruiting people to aid their schemes.
The trend shows that attackers can leverage emerging AI during the hacking process, including attack scenario planning, malware development, building their tools, and impersonating job recruiters, said Mun Chong-hyun, director at Genians.
Phishing targets in this latest cybercrime spree included South Korean journalists and researchers and human rights activists focused on North Korea. It was also sent from an email address ending in .mli.kr, an impersonation of a South Korean military address.
Exactly how many victims were breached wasn’t immediately clear.
Also Read | Here's what India's top Mutual Funds bought and sold in August
Genians researchers experimented with ChatGPT while investigating the fake identification document. As reproduction of government IDs is illegal in South Korea, ChatGPT initially returned a refusal when asked to create an ID. But altering the prompt allowed them to bypass the restriction.
American officials have alleged that North Korea is engaged in a long-running effort to use cyberattacks, cryptocurrency theft and IT contractors to gather information on behalf of the government in Pyongyang. Those tactics are also used to generate funds meant to help the regime subvert international sanctions and develop its nuclear weapons programs, according to the US government.
Attackers used the artificial intelligence tool to craft a fake draft of a South Korean military identification card to create a realistic-looking image meant to make a phishing attempt seem more credible, according to research published Sunday by Genians, a South Korean cybersecurity firm. Instead of including a real image, the email linked to malware capable of extracting data from recipients’ devices, according to Genians.
The group responsible for the attack, which researchers have dubbed Kimsuky, is a suspected North Korea-sponsored cyber-espionage unit previously linked to other spying efforts against South Korean targets. According to a 2020 advisory, the US Department of Homeland Security said Kimsuky “is most likely tasked by the North Korean regime with a global intelligence-gathering mission. "
Also Read | Urban Company IPO allotment expected on September 15: Steps to check status, listing date and other key details
The July findings by Genians are the latest example of suspected North Korean operatives deploying AI as part of their intelligence-gathering work. In August, Anthropic said it discovered North Korean hackers used the Claude Code tool to get hired and work remotely for US Fortune 500 tech companies. In that case, Claude helped them build elaborate fake identities, pass coding assessments, and deliver actual technical work once hired.
OpenAI representatives didn’t immediately respond to a request for comment outside normal hours. The company said in February it had banned suspected North Korean accounts that had used the service to create fraudulent résumés, cover letters and social media posts to try recruiting people to aid their schemes.
The trend shows that attackers can leverage emerging AI during the hacking process, including attack scenario planning, malware development, building their tools, and impersonating job recruiters, said Mun Chong-hyun, director at Genians.
Phishing targets in this latest cybercrime spree included South Korean journalists and researchers and human rights activists focused on North Korea. It was also sent from an email address ending in .mli.kr, an impersonation of a South Korean military address.
Exactly how many victims were breached wasn’t immediately clear.
Also Read | Here's what India's top Mutual Funds bought and sold in August
Genians researchers experimented with ChatGPT while investigating the fake identification document. As reproduction of government IDs is illegal in South Korea, ChatGPT initially returned a refusal when asked to create an ID. But altering the prompt allowed them to bypass the restriction.
American officials have alleged that North Korea is engaged in a long-running effort to use cyberattacks, cryptocurrency theft and IT contractors to gather information on behalf of the government in Pyongyang. Those tactics are also used to generate funds meant to help the regime subvert international sanctions and develop its nuclear weapons programs, according to the US government.
Do you find this article useful?
