North Korean hackers leverage AI and shared infrastructure for cyberattacks

European cybersecurity firms Kudelski Security and Sequoia have reported that North Korean IT workers and state-linked hacking groups are increasingly sharing the same internet infrastructure. This overlap suggests that North Korean workers, who often use fake identities to secure employment at Western companies for foreign currency generation, may also be leveraging their internal access to conduct intelligence gathering and cyber operations.

Research indicates that these workers use shared VPN exit addresses to mask their locations, blurring the line between legitimate employment and malicious activity. The report also identified six distinct activity groups, such as ‘CryptoCore’ and ‘Jade Slit’, which focus on tasks ranging from cryptocurrency theft to information collection.

Simultaneously, there is a rising trend of state-sponsored hacking groups from North Korea and China utilizing artificial intelligence to automate attacks. Experts warn that AI-driven attacks using autonomous agents could become prominent by the end of the year. North Korean groups, including Kimsuky, have been observed setting up local AI environments to develop malware and conduct reconnaissance without relying on external services. Meanwhile, Chinese-linked groups are reportedly using models like DeepSeek to increase the frequency of their attacks, benefiting from the model's high performance and relatively loose security safeguards.