AI-driven cyberattack trends by China and North Korea

The global cyber threat landscape is experiencing a rapid shift driven by the integration of artificial intelligence. Reports indicate that AI is being used to automate and scale attacks, including the generation of payloads and shell commands. Chinese-linked groups, such as ‘Vault Panda’ and ‘Genesis Panda’, have demonstrated the ability to exploit software vulnerabilities within 24 hours of disclosure, while North Korean-linked actors like ‘Stardust Chollima’ have targeted the AI ecosystem by injecting malicious packages into AI framework instances.

Further developments show that North Korean IT workers and state-linked hacking groups are increasingly sharing internet infrastructure, using fake identities to secure Western employment while conducting intelligence gathering. Groups such as ‘CryptoCore’ and ‘Jade Slit’ have been identified in these operations.

There is a growing trend of North Korean and Chinese state-sponsored groups utilizing AI to automate attacks. North Korean groups, including Kimsuky, are reportedly setting up local AI environments to develop malware and conduct reconnaissance. Concurrently, Chinese-linked groups are utilizing models like DeepSeek to increase attack frequency, leveraging the model’s performance and security characteristics.