The Takeaway<\/p>\n
North Korea is using artificial intelligence (AI) to automate its analysis of stolen information, generate more persuasive phishing materials, accelerate malware development, and disguise the identities of its legion of cybercriminals. These tactics, and the technology behind them, increase the threat to Canada and other vulnerable Indo-Pacific states.\u00a0<\/p>\n
North Korea\u2019s AI-automated cyberattacks are largely financially motivated and increasingly focused on cryptocurrency. As\u00a0Pyongyang becomes more adept at exploiting generative AI to target highly connected financial, technology, research, and critical-infrastructure sectors, Canada will need to strengthen its international collaboration, including with Japan, South Korea, and the U.S., which are also frequent targets of North Korea-backed cybercrime.<\/p>\n
In Brief<\/p>\n
On August 10, 2026, South Korean cybersecurity firm Genians reported<\/a> that Kimsuky, a North Korean hacking group, is building and using locally run AI systems to analyze stolen data and create more sophisticated phishing campaigns. This suggests a shift from simply using generative AI for deceptive content toward integrating AI more deeply into broader cyber operations, including malware development and automated cyberattacks.\u00a0 Implications<\/p>\n For Canada, the targets of North Korea\u2019s AI-powered cybercrime will shift from government organizations to industry and business actors with high-value digital assets. Canadian firms can be targeted indirectly through their contractors, employees, cloud services, software dependencies, or third-party technology providers.\u00a0<\/p>\n The recent use<\/a> of fake employment and interview schemes is particularly relevant to Canada’s growing advanced technology sector and globally distributed workforce. For instance, in 2025<\/a>, Canadian architect Stephen Mauro did not realize that a North Korean remote IT worker had used a false identity to obtain employment with a third party and then misused Mauro\u2019s professional credentials and seal. Other online researchers have revealed<\/a> North Korean agents asking ChatGPT for Canadian civil engineering project codes. These examples illustrate how North Korea’s IT worker schemes can exploit legitimate Canadian professional identities and employment relationships.<\/p>\n AI enables North Korea to circumvent previous limitations \u2014 such as limited overseas presence and language barriers \u2014 and Canada’s response must account for this new reality.\u00a0While traditional cybersecurity emphasized safeguarding online infrastructure through tools such as secure VPNs and password protections, AI-enabled cybercriminals are turning to social engineering<\/a> \u2014 that is, the practice of obtaining confidential information by manipulation and phishing of legitimate users \u2014 to push the limits of how a fake identity can be forged. A convincing AI-generated email, work deliverables, and video conferences can exploit an employee without resorting to a software vulnerability.\u00a0<\/p>\n Overall, AI makes it easier for malicious cyberactivity to take place. Previously isolated, technologically disadvantaged actors from North Korea can now conduct phishing,\u00a0\u201cvishing\u201d (voice scams), and deepfake impersonation faster and more frequently, and even carry out consolidated attacks<\/a>. Not only can it disrupt operations and create financial and regulatory losses for Canadian businesses and government organizations, but it can also erode public trust with attacks on broader civil society.<\/p>\n With AI-enhanced social engineering, North Korea is now able to rapidly scale its supply-chain attacks against open-source developers to potentially gain access to downstream software ecosystems. This year, for example, North Korea reportedly compromised<\/a> axios, the popular open-source JavaScript library, demonstrating how malicious actors can exploit trusted developers to potentially reach millions of downstream users.<\/p>\n What\u2019s Next<\/p>\n 1. Alerting the Canadian public to Pyongyang\u2019s cyber capabilities 2. Canada\u2019s cyber resilience should emphasize human, organizational vulnerabilities\u00a0 3. Higher cybersecurity standards\u00a0 4. Indo-Pacific allies as information-sharing partners\u00a0 \u2022\u00a0Edited by: Erin Williams, Acting Vice-President, Research, and Ted Fraser, Senior Editor\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"The Takeaway North Korea is using artificial intelligence (AI) to automate its analysis of stolen information, generate more…\n","protected":false},"author":2,"featured_media":858332,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[49,48,44],"class_list":["post-858331","post","type-post","status-publish","format-standard","has-post-thumbnail","category-canada","tag-ca","tag-canada","tag-news"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/858331","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=858331"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/858331\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/858332"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=858331"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=858331"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=858331"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u00a0
\nNorth Korea pursues cryptocurrency theft as it directly generates hard currency for the heavily sanctioned regime. In 2025, North Korean actors stole an estimated US$2.02 billion<\/a> in cryptocurrency, and in the first half of 2026, just two attacks<\/a>, also attributed to North Korea, accounted for over US$500 million in losses. As Pyongyang continues to face economic sanctions, the benefits of cybercrime far outweigh the costs \u2014 these stolen assets reportedly contribute anywhere from one-third to one-half of the country\u2019s annual budget<\/a>. This fast-rising<\/a> state-sponsored cybercrime ecosystem generates illicit revenue for the regime to support its strategic and military objectives, which are at odds with Canadian interests.\u00a0
\u00a0
\nAI makes these cybercrimes harder to detect. North Korea uses stolen identities to create credible digital personas and secure remote jobs at foreign companies, generating illicit revenue and potentially gaining insider access to corporate systems. AI tools<\/a> such as generative AI for r\u00e9sum\u00e9s, AI-image editing and face-swapping, and voice-changing software make these encounters more convincing. Not only does AI help North Korean IT workers create more realistic professional materials, but these crimes are increasingly intertwined with legitimate technology ecosystems<\/a>, making detection more difficult.\u00a0
\u00a0
\nOn July 31<\/a>, for the first time, Canada joined 10 like-minded partners \u2014 Australia, France, Germany, Italy, Japan, the Netherlands, New Zealand, South Korea, the U.K., and the U.S. \u2014 in a joint statement, warning that North Korean IT workers are using false identities, third-country proxies, and even \u201claptop farms\u201d to obtain overseas employment to funnel income to North Korea\u2019s illicit weapons programs. The July joint statement, coming on the heels of an\u00a0FBI disclosure<\/a> of an ongoing investigation into North Korean IT workers, is likely an effort by Canada to match\u00a0an August 2025 statement<\/a> by the U.S., Japan, and South Korea, and reflects Canada\u2019s burgeoning cybersecurity co-operation with\u00a0Japan<\/a> and\u00a0South Korea<\/a>.\u00a0<\/p>\n
The Canadian Centre for Cyber Security\u2019s most recent assessment pays less attention to North Korea than to China, Russia, and Iran. Similarly, Canada’s 2025 National Cyber Security Strategy should address key threats by name and tailor its cyber operation strategy accordingly, instead of taking a blanket approach and broadly calling out \u201cmalicious cyber actors<\/a>.\u201d\u00a0 \u00a0<\/p>\n
Given the prevalence of small and medium enterprises that often lack the resources and organizational capacity to more thoroughly vet remote workers and contractors, Canada remains especially vulnerable to fraudulent North Korean IT workers using stolen identities or AI-generated personas.\u00a0<\/p>\n
To counter North Korea\u2019s AI-boosted cybercrime more effectively, Canada needs to establish higher cybersecurity standards for its critical infrastructure, financial institutions, and third-party organizations handling sensitive government or research data, with priority given to phishing-resistant authentication and regular exercises simulating AI-enhanced attacks.<\/p>\n
There is an opportunity for Canada to expand information-sharing beyond its Five Eyes partners (Australia, New Zealand, the U.K., and the U.S.) and fellow NATO countries to include South Korea<\/a>, Japan<\/a>, and other Indo-Pacific partners. For example, South Korea dealt with North Korea\u2019s massive, long-running cyberattacks on its military<\/a> facilities in 2017 and its government institutions<\/a> and thriving semiconductor industry<\/a> in 2024. As a world leader in fundamental AI technology, Canada can shift from isolated-incident responses toward a more proactive, AI-assisted approach of hunting down vulnerabilities in its online financial system and cryptocurrency transactions before North Korean hackers reach them.\u00a0<\/p>\n