Cybersecurity defenses have traditionally relied heavily on recognizable indicators: known malware signatures, suspicious files, malicious domains, and other artifacts that can be identified and blocked. Increasingly, however, threat actors are combining legitimate system utilities, obfuscated scripts, social engineering, and generative AI to make attacks more difficult to identify through any single indicator.
Kimsuky, a North Korean state-linked espionage group, provides a recent example. In a 2025 campaign targeting South Korean organizations, researchers found that attackers used an AI-generated image resembling a South Korean military identification card as part of a spear-phishing operation. The image was reportedly generated with ChatGPT and used to make a phishing message appear more credible. Genians Security Center assessed the image as AI-generated with 98% probability.
The significance of this activity extends beyond one phishing campaign. Generative AI may allow attackers to produce convincing content more quickly, while script obfuscation and the use of legitimate system tools can make subsequent activity harder to identify through traditional signature-based controls.
For organizations in defense, critical infrastructure, technology, and their supply chains, this creates a broader trust challenge. Security teams may need to place less emphasis on whether an individual file, image, or document looks legitimate and more emphasis on whether the overall sequence of activity is consistent with expected behavior.
The Trust Problem Has Changed
Social engineering has long been an important component of Kimsuky’s operations. What is changing is the ease with which attackers can create supporting material that reinforces a false narrative.
In the 2025 campaign analyzed by Genians, attackers impersonated a defense-related institution and used a forged military identification card to support the phishing scenario. The malicious material included PowerShell shortcuts that deployed backdoors and enabled data extraction, while the AI-generated image was used as part of the deception.
AI does not necessarily create an entirely new attack technique. Instead, it can strengthen existing techniques by making fraudulent content easier to produce and adapt.
For business-to-business organizations, it’s an important distinction. Supply chains frequently depend on digital communications, credentials, documentation, and third-party relationships. When an attacker can make those signals appear more credible, employees may have fewer obvious visual cues that something is wrong.
That does not mean visual verification has no value. Rather, it suggests that visual inspection should not be treated as the only control for establishing identity or authorization. A document that looks authentic may still require independent verification.
AI-Enhanced Lures and the Limits of Visual Verification
The Kimsuky campaign demonstrates how generative AI can contribute to a more convincing social engineering narrative.
According to Genians, the attackers used ChatGPT to generate a realistic military identification image and incorporated it into a phishing campaign directed at South Korean targets. The research found evidence that the image had been generated using generative AI, despite safeguards intended to prevent the creation of government identification documents.
The security implication is that attackers can successfully combine synthetic, AI-generated content with other familiar trust signals: institutional branding, plausible terminology, impersonated domains, and an apparently routine business request.
This can make individual verification steps less reliable when they are considered in isolation.
Organizations may therefore benefit from verification processes that combine multiple signals, such as:
- Independently verifying requests involving sensitive information or access.
- Checking whether the sender, domain, and communication channel are consistent with established organizational records.
- Requiring stronger authentication for high-risk actions.
- Validating identity information against authoritative sources where appropriate.
- Correlating endpoint, identity, email, and network activity rather than evaluating each event separately.
Why Traditional Antivirus Might Not Be Enough
The technical portion of the Kimsuky campaign also illustrates the limitations of relying exclusively on static indicators.
Researchers reported that malicious attachments included PowerShell shortcuts capable of deploying backdoors and extracting information. Related analysis of the campaign described the use of batch files and AutoIt scripts as part of the attack chain.
This is an example of a broader living-off-the-land approach, in which attackers use legitimate operating-system utilities or commonly installed software rather than relying entirely on a distinctive custom executable.
PowerShell, command-line utilities, scripting engines, and other administrative tools have legitimate purposes in enterprise environments. As a result, their presence alone is generally not enough to establish malicious activity. The more useful signal may be the context in which these tools operate.
For example, security teams may want to investigate combinations of events, including:
- A user opening an unexpected attachment.
- A shortcut launching PowerShell.
- Encoded or heavily obfuscated command-line activity.
- Unusual child processes or script interpreters.
- Unexpected changes to scheduled tasks.
- Connections to previously unseen infrastructure.
- Credential use that differs from the user’s normal behavior.
This approach does not eliminate the value of signatures and indicators of compromise. Instead, it supplements them with behavioral and contextual analysis that may remain useful when the underlying malware or command sequence changes.
Hiding in Plain Sight and the Legitimate Software Problem
Another challenge is the abuse of legitimate software and familiar system processes.
Analysis of the Kimsuky campaign identified activity involving Hancom Office update functionality, with a scheduled task used to support recurring execution. Reporting on the campaign described the task as being disguised as a Hancom Office update process.
Techniques such as this can exploit an organization’s assumptions about trusted software. A process associated with a familiar application may receive less scrutiny than an unknown executable, particularly in environments where monitoring focuses primarily on new or unsigned software.
This does not mean legitimate software should automatically be considered suspicious. Instead, it means organizations may need to examine whether a legitimate process is behaving as expected.
Useful controls can include monitoring:
- Creation and modification of scheduled tasks.
- Unusual parent-child process relationships.
- Unexpected script execution by trusted applications.
- Changes to startup and persistence mechanisms.
- Outbound connections initiated by applications that do not normally communicate externally.
- Deviations from established software behavior.
A zero-trust approach can reinforce these controls by treating trust as something that is continuously evaluated rather than permanently granted.
The Economic Dimension of AI and North Korean IT Worker Schemes
The use of AI in North Korean operations extends beyond phishing and espionage. North Korean IT worker schemes have also used fraudulent identities, stolen personal information, and falsified documentation to obtain employment with companies outside the country.
The U.S. Department of the Treasury has documented these schemes. In January 2025, Treasury said North Korea deployed thousands of skilled IT workers globally and that workers used aliases and falsified identification credentials to obtain contracts. Treasury estimated that these operations generated hundreds of millions of dollars annually for the North Korean regime, with the government withholding up to 90% of workers’ wages in some cases.
The U.S. Department of Justice similarly reported in 2024 that North Korean IT workers had infiltrated more than 300 U.S. companies while posing as U.S. citizens or residents and using stolen or borrowed identities.
More recent Treasury reporting indicates that the scale is still significant, stating in March 2026 that the DPRK government-orchestrated IT worker schemes generated nearly $800 million and involved fraudulent documentation, stolen identities, and fabricated personas.
Generative AI adds another layer to this problem by making it easier to create or modify professional profiles, application materials, and other supporting content. However, organizations should distinguish documented uses of AI from broader claims about how extensively it is being used in individual recruitment operations.
For HR and recruitment teams, the practical lesson is straightforward: identity verification should not depend solely on the consistency or quality of submitted documents.
The Behavioral Monitoring Imperative
These developments reinforce the value of behavioral monitoring alongside conventional endpoint security.
Endpoint Detection and Response platforms can help security teams connect events that might appear benign when viewed independently. A PowerShell process may be legitimate. A scheduled task could also be legitimate. The combination, timing, and relationship between those events may provide a more useful security signal.
Security teams can consider capabilities such as:
Script and Command Visibility
PowerShell logging and related telemetry can provide visibility into commands executed on endpoints. Where appropriate, organizations can configure logging and monitoring to capture sufficient information for investigation, including script activity and command-line parameters.
Behavioral Baselines
Organizations can establish baselines for legitimate administrative tools and identify deviations. For example, PowerShell launched by an approved administrative process may be expected, while the same interpreter launched from an unusual document or shortcut may warrant additional investigation.
Cross-system correlation
Email, endpoint, identity, network, and cloud events can provide a more complete picture when analyzed together. Correlating these signals can help distinguish isolated anomalies from coordinated activity.
Threat intelligence
Threat intelligence can provide additional context about known threat actors, infrastructure, tactics, techniques, and procedures. This information can support detection and investigation without requiring defenders to rely exclusively on static indicators.
The objective is not to abandon signature-based detection. Signatures, hashes, domains, and other indicators can remain useful. But those controls should be supported by behavioral analysis that can adapt when attackers change the artifacts they use.
Navigating the New Threat Reality
The integration of generative AI into Kimsuky’s operations has fundamentally altered the threat landscape for organizations in defense, critical infrastructure, and adjacent supply chains. The combination of deepfake technology with advanced script obfuscation establishes a new standard for state-sponsored espionage that traditional static defenses cannot address.
Security leaders must recognize that this evolution requires a corresponding evolution in defensive strategy. The transition to behavioral monitoring is not optional but necessary to protect institutional assets against attackers who leave no traditional forensic footprint. Equally important, decision-makers must implement more robust identity verification protocols that acknowledge the reality of synthetic fraud.
The threat sits at the intersection of technology, psychology, and economics. Addressing it requires coordination across security, HR, finance, and executive leadership. Organizations that treat AI-augmented threats as merely a technical problem will find themselves perpetually reactive, addressing individual incidents rather than the systemic vulnerabilities that enable them.
The path forward demands both technological investment in behavioral detection capabilities and organizational commitment to verification processes that assume deception is the default rather than the exception.
