A North Korean hacking group known as Kimsuky has carried out a new cyberattack against South Korea by using artificial intelligence to generate fake military identification cards. Security researchers discovered that the group used these forged IDs in targeted phishing campaigns aimed at organizations linked to South Korea’s defense sector.
Researchers from Genians, a South Korean cybersecurity firm, explained that the attackers used AI tools such as ChatGPT to create a realistic-looking draft of a South Korean military ID. This forged ID was then included in spear-phishing emails, making the messages appear official and trustworthy. By attaching or embedding what looked like a genuine government-issued document, the attackers increased their chances of deceiving the recipients.
The campaign was carefully designed to target individuals and organizations related to defense rather than being a random spam operation. Unlike ordinary phishing emails, which are usually sent to large numbers of people, these were highly personalized. The attackers studied their victims in advance and tailored the messages to look authentic, hoping that the targets would lower their guard and click on links or download files.
If a recipient did fall for the trick and interacted with the malicious attachments or links, it could lead to malware being installed on their device. This malware was capable of stealing sensitive information and potentially giving remote access to the attackers. Experts say this aligns with Kimsuky’s history of conducting cyber espionage and data theft on behalf of North Korean intelligence.
The use of artificial intelligence in this campaign highlights how cybercriminals are adapting new technology to make their attacks more effective. In the past, creating a convincing fake identification card required either advanced graphic design skills or access to stolen templates. Now, with the help of AI, even attackers with limited resources can quickly generate highly realistic fake documents. This makes it far more difficult for the average person to recognize phishing attempts.
Researchers have also warned that attackers are finding ways to bypass the built-in restrictions of AI systems. By using carefully designed prompts or “jailbreak” methods, they can push these tools to generate content that is normally restricted, such as fake IDs. This creates an even bigger challenge for cybersecurity teams, as many of the traditional signs of phishing like poor grammar or obvious design flaws are being eliminated.
Kimsuky has been active for years and is well known for targeting South Korea, the United States, and other countries to gather sensitive information. Its operations usually focus on military, political, and strategic intelligence. This latest attack is another reminder of how North Korea uses cyber operations as a cost-effective and low-risk method of espionage compared to traditional spying.
Experts recommend that individuals and organizations treat unexpected emails with caution, even if they appear to include official documents. Verification of the sender through a separate communication channel is strongly advised before opening attachments or clicking on links. Organizations are also urged to strengthen their defenses with advanced email filters, endpoint detection tools, and multi-factor authentication. Training employees to recognize sophisticated phishing attempts is becoming increasingly important, as attackers are now using AI to create messages that look nearly perfect.
The discovery of AI-generated military IDs in this attack shows that cyber threats are entering a new phase. What once took significant effort can now be achieved in minutes with publicly available tools. South Korea’s defense sector may have been the immediate target, but this tactic could easily spread to other industries and even ordinary citizens. The incident serves as a warning that staying ahead of cybercriminals requires constant awareness, updated security measures, and global cooperation to address the risks posed by the misuse of artificial intelligence.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
