Microsoft: North Korea-linked groups use AI for target research, false identities

309 US firms infiltrated; illicit revenue tops $17 million

Cyber operations expand from virtual asset theft and defense hacking into hiring and remote work

[123rf]
[123rf]

North Korea's cyber threat has expanded well beyond stealing virtual assets and hacking defense technology, now extending to AI-assisted identity fraud and infiltration of overseas companies. Analysts say North Korean operatives are actively using generative AI to research targets, craft resumes and prepare interview responses — deploying the technology to sharpen the efficiency of existing attack methods.

Microsoft's threat intelligence unit said in a report published Tuesday that North Korea-linked groups are using AI for target research, creating impersonation content, maintaining false identities and developing attack tools.

The operatives are particularly using generative AI to approach targets under the pretense of job offers or interviews and to secure actual employment at overseas companies using fabricated identities. AI is used across the process — from crafting tailored outreach messages and fake resumes and profiles to preparing interview answers and polishing foreign-language expression.

However, the entire attack process is not believed to be fully automated by AI. Based on confirmed cases to date, Microsoft assessed that North Korea-linked groups are using AI not as an autonomous attack agent but as a supplementary tool to boost the productivity and efficiency of existing operations. The actual attacks are still directed by humans, the company said.

North Korea's cyber operations have targeted government agencies, financial institutions and defense contractors through multiple groups. Lazarus, Andariel and Kimsuky are among the most frequently cited.

Those names, however, do not necessarily correspond to official organizational designations within North Korea. Global cybersecurity firms often assign different names to the same groups as they track attack methods and behavioral patterns. Microsoft classifies Lazarus as "Diamond Sleet," Andariel as "Onyx Sleet" and Kimsuky as "Emerald Sleet."

[Reuters]
[Reuters]

Attacks by these groups on domestic defense contractors have also been confirmed in South Korea. The Korean National Police Agency's National Investigation Headquarters said in April 2024 that more than 10 South Korean defense companies had been compromised by Lazarus, Andariel and Kimsuky. The attackers used not only direct intrusions but also a method of first hacking subcontractors or maintenance firms with relatively weaker security before gaining access to internal networks.

Virtual asset theft is identified as a primary funding mechanism for North Korea's cyber operations. Mandiant, a cybersecurity firm under Google, said in a 2023 report that North Korea-linked group APT43 launders stolen virtual assets to fund operational infrastructure and other costs.

Investigators also found that the group used stolen virtual assets to rent computing power for cryptocurrency mining, then received newly mined coins in separate wallets — a method designed to sever the blockchain trail linking the original stolen assets to the newly acquired ones.

More recently, a growing threat has emerged beyond hacking: North Korean IT workers obtaining remote jobs at overseas companies using fabricated identities.

In the United States, authorities uncovered so-called "laptop farms" — operations where individuals locally stored and managed work laptops issued by companies to help North Korean IT workers perform remote jobs.

According to the US Department of Justice, Christina Marie Chapman, a US citizen who helped North Korean IT workers secure employment under false identities, was sentenced to 102 months in prison in July 2025. The scheme involved the theft of identities belonging to 68 US citizens and helped North Korean IT workers gain employment at 309 US companies. Illicit revenue from the operation exceeded $17 million.

The infiltration goes beyond simply earning wages. The FBI warned in January 2025 that there were cases in which North Korean IT workers stole sensitive information and source code from their employers and then demanded money in exchange for not exposing it.


rim@heraldcorp.com