North Korean hackers use ChatGPT to scam Linkedin users

Recent reports reveal that North Korean hackers are leveraging ChatGPT on platforms like LinkedIn to deceive users into divulging sensitive information. OpenAI, the parent company of ChatGPT, and investor Microsoft disclosed the disruption of five state-linked threat actors employing AI services for malicious cyber activities. Identified through Microsoft Threat Intelligence were threat actors from China (Charcoal Typhoon, Salmon Typhoon), Iran (Crimson Sandstorm), North Korea (Emerald Sleet), and Russia (Forest Blizzard), whose accounts were terminated.

Microsoft highlighted that Emerald Sleet, a.k.a. Kimsuky, masqueraded as reputable entities such as academic institutions and NGOs on LinkedIn to coax victims into sharing expert commentary on North Korea-related foreign policies. While no major cyberattacks have been attributed to these actors, the findings underscore an exploration of AI technology’s potential applications by adversaries, according to Microsoft.

Furthermore, OpenAI disclosed that North Korea’s Emerald Sleet used ChatGPT to pinpoint defense-focused experts and organizations in the Asia-Pacific region, identify vulnerabilities, aid in scripting tasks, and craft content for potential phishing campaigns. The South Korean National Intelligence Service noted an increase in hacking attempts, with suspicions that North Korea integrates generative AI into hacking operations to identify targets and acquire necessary hacking technologies.

Erin Plante, Vice President of Investigations at Chainalysis, emphasized that North Korean hacking groups create authentic-looking recruiter profiles on professional networking sites like LinkedIn, emphasizing generative AI’s role in establishing connections with targets. Despite concerns, OpenAI reassured that the capabilities of ChatGPT, specifically GPT-4, in supporting malicious cybersecurity endeavors are constrained by existing tools publicly available and not leveraging AI significantly.

In a separate incident from last year, it was reported that North Korean-backed hackers targeted cryptocurrency clients by exploiting the systems of a U.S. enterprise software company, JumpCloud. These developments underscore the evolving strategies and techniques employed by state-linked threat actors in cyber operations, urging heightened vigilance and cybersecurity measures across digital platforms.