HISPI Project Cerebellum HISPI PROJECT CEREBELLUM

North Korea's Kimsuky Group Reportedly Uses AI-Generated Military ID Deepfakes in Phishing Campaign

July 17, 2025

Genians revealed a phishing campaign orchestrated by North Korea's Kimsuky group, involving AI-manipulated deepfake military ID cards. The emails, apparently from South Korean defense institutions, contained ZIP files containing forged IDs with photos seemingly created using generative AI. Upon opening, hidden malware was reportedly activated, downloading disguised scripts as Hancom Office updates. This incident signifies an advancement in Kimsuky's tactics, leveraging AI decoys to bolster social engineering.

Join us at HISPI Project Cerebellum and help establish governance for AI incidents like this one by contributing to our AI Incident Database. Together, we can work towards ensuring safe and secure AI practices. JOIN US

Matched TAIM controls

Suggested mapping from embedding similarity (not a formal assessment). Browse all TAIM controls

Alleged deployer
velvet-chollima, thallium, reconnaissance-general-bureau, kimsuky-group, group-0094, emerald-sleet, black-banshee, apt43, government-of-north-korea
Alleged developer
openai
Alleged harmed parties
truth, south-korean-defense-personnel, national-security-and-intelligence-stakeholders, government-of-south-korea, general-public-of-south-korea, epistemic-integrity

Source

Data from the AI Incident Database (AIID). Cite this incident: https://incidentdatabase.ai/cite/1208

Data source

Incident data is from the AI Incident Database (AIID).

When citing the database as a whole, please use:

McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. In Proceedings of the Thirty-Third Annual Conference on Innovative Applications of Artificial Intelligence (IAAI-21). Virtual Conference.

Pre-print on arXiv · Database snapshots & citation guide

We use weekly snapshots of the AIID for stable reference. For the official suggested citation of a specific incident, use the “Cite this incident” link on each incident page.