North Korean Hackers Use AI Generated Military ID Images to Target South Korea

A routine design request concealed a route into computers

North Korea's Kimsuky hacking group used convincing images of South Korean military employee identification cards to support a targeted phishing campaign detected in mid July, according to an analysis by a South Korean cybersecurity firm. The emails asked recipients to review sample ID designs for civilian staff. Behind that ordinary administrative request was a delivery chain carrying malware capable of giving attackers control of a victim's computer.

Investigators found evidence that generative artificial intelligence had helped produce the badge images. A detector assessed one image as having a 98 percent probability of being AI generated. Metadata in at least one sample referenced GPT 4o and ChatGPT, suggesting that an OpenAI image generation pipeline had been used during testing or production. Metadata is information stored inside a file, such as details about how it was created.

The emails impersonated a defense related institution responsible for issuing identification cards. Attached PNG images resembled draft badge designs, giving recipients something that appeared relevant to the request. The malicious files delivered through the same chain were intended to install a backdoor, a program that lets an attacker enter and control a computer remotely.

The sender address supplied another familiar cue. Investigators observed false domains such as .mli.kr, a near match for South Korea's official defense suffix, .mil.kr. The letters are almost identical, but their order changes. Someone moving quickly through a crowded inbox could mistake the imitation for an official military address.

As of September 17, 2025, the campaign showed how an established espionage operation could combine familiar tricks with AI generated visual material. Its targets included a military related organization, researchers, journalists, and activists concerned with North Korea. The lure depended on making a dangerous request look like routine office work.

Why a military badge was a persuasive lure

Kimsuky's emails exploited a recognizable administrative process: checking a draft identity document before it is issued. The request did not need to sound urgent or extraordinary. Reviewing a photograph, a font, or the placement of information on a badge could appear to be an ordinary task inside a defense bureaucracy.

The attackers reinforced that story with several details. The sender appeared connected to an institution authorized to issue IDs. The domain resembled a military address. The image looked like the document under discussion. Each element made the next one easier to accept.

Some archives were personalized with a partially masked version of the recipient's real name. That detail could make the message feel directed at a particular employee rather than sent indiscriminately. Spear phishing is this kind of targeted deception: an attacker shapes a message around a person or organization to persuade them to open a file, follow a link, or take another action.

Identity documents also invite collaboration. Employees may expect exchanges about photographs, layout, and other design choices, while the document itself carries a sense of official authority. The attackers used that expectation to make an attachment seem useful and relevant.

The campaign was described as a carefully targeted operation seeking access to specific networks and inboxes, rather than a broad distribution of generic messages. No number of successful infections or amount of stolen data was given.

How the attachments delivered a backdoor

Recipients received either a ZIP archive or a download link carrying an image and one or more scripts. A ZIP archive bundles files together; a script contains commands that a computer can execute. Once a target launched the malicious content, the chain connected the computer to attacker infrastructure and retrieved additional components.

In one observed case, an archive contained a shortcut disguised as an ordinary document. Launching it ran a PowerShell command that contacted a remote server, fetched a backdoor, and downloaded the decoy PNG showing the ID card. PowerShell is a Windows tool used to automate tasks, which makes it useful to administrators and attractive to attackers who misuse it.

Another delivery package included a batch file named LhUdPC3G.bat. It executed alongside the image and initiated malicious activity, including establishing persistence, enabling data theft, and allowing remote control. Persistence means arranging for malicious access to continue, including after the initial interaction has ended.

The badge image served as the visible explanation for opening the package. The scripts performed the intrusion. A recipient expecting a design sample could see the image and feel that the email had delivered what it promised, while malicious commands were operating through the same delivery chain.

The operation therefore combined persuasion with software execution. The imitated institution and domain encouraged trust; the personalized archive encouraged opening; the shortcut or batch file provided the route to running commands. The backdoor then gave the attackers a way to maintain access and steal information.

How the attackers appear to have used AI

Investigators assessed that the images were likely created by asking a commercial AI system for testing samples or internal mock ups, rather than presenting the request as an attempt to create real credentials. Most mainstream AI tools refuse requests to reproduce government issued IDs because such copying is illegal and can support fraud.

Framing an image as a harmless design exercise can steer a model toward accepting a request it might otherwise reject. The technique was described as prompt injection or jailbreaking: crafting instructions that push an AI system around its safety rules by changing how the task is presented.

The suspected method matters because the badge did not have to function as a real credential. It needed to look plausible enough to support an email about reviewing a draft. A design framed as a sample could still give the attackers the visual credibility they wanted.

The 98 percent detector result and the metadata references to GPT 4o and ChatGPT supported the investigators' assessment of AI involvement. The exact prompts and production process were not disclosed. The practical role of the image was straightforward: it helped a hurried employee accept the story of a harmless badge review.

June activity led into the July campaign

Kimsuky had used a ClickFix style lure in June, before the campaign detected in mid July. ClickFix messages encourage a person to take an action presented as a solution to a supposed problem. In the June activity, recipients were nudged to press a button to resolve an issue.

The July operation reused the same malware family and many of the earlier techniques, while adding AI generated design samples. Knowledge gained during the earlier activity appears to have carried into the later campaign. The change was in how the attackers presented the trap, alongside continued use of familiar intrusion tools.

The sequence places the ID card lure within a developing pattern of activity:

• June 2025: Researchers documented ClickFix themed emails associated with Kimsuky and the malware later used in the ID card campaign.
• Mid July 2025: Investigators first detected the campaign using military employee ID images and an administrative review request.
• August 2025: A major AI developer reported disrupting North Korean operators using its model for false identities and remote employment schemes.
• September 17, 2025: The ID card campaign illustrated the use of AI generated imagery alongside established phishing and malware techniques.

Attribution to Kimsuky rested on technical and contextual evidence, including shared malware code, reused infrastructure, language patterns, and the choice of targets. Those indicators aligned with activity previously linked to the group.

Intelligence gathering and a wider search for revenue

Government agencies and private researchers have tracked Kimsuky for years as a North Korean intelligence gathering unit. Its assessed mission includes collecting policy, military, and technology information that matches state priorities. Government agencies, defense related institutions, think tanks, academic researchers, journalists, and human rights organizations focused on North Korea feature among its targets.

The ID campaign matched that focus. Access to a relevant employee's computer or inbox could give the attackers an entry into institutions studying North Korea or handling defense matters. Maintaining that access is part of the group's established approach to collecting information.

North Korean operators have also used AI in schemes involving employment and false identities. In August, a major AI developer said it had disrupted operatives who used its model to create identities, apply for remote jobs at United States technology firms, and complete technical work after being hired. The company banned accounts associated with the activity and updated its systems for detecting malicious use.

Security briefings in South Korea and the United States have warned about AI being used to write fluent emails, create resumes and cover letters, draft code, and build personas with professional profile photographs. These tools allow a small operation to produce the polished material associated with a much larger team.

Public information in 2023 cited millions of daily attack attempts against South Korean government systems, with many traced to North Korean activity. United Nations reporting and industry research have also tied North Korean units to large cryptocurrency thefts used to fund strategic programs. Espionage, employment fraud, and financial theft contribute to a broader effort to gather intelligence and generate revenue despite sanctions.

Operators based in China and other actors linked to states are also experimenting with generative AI. The North Korean activity shows its use across both intelligence collection and illicit finance, with prompts and open source tools helping produce material that previously demanded more design, translation, and programming work.

What AI changes in social engineering

Generative AI can produce images, text, and code tailored to a target audience with little effort. For a phishing operator, a plausible badge sample or branded letterhead gives an invented request a convincing appearance. Formal bureaucratic Korean, familiar acronyms, and a respectful tone can make a message seem consistent with institutional correspondence.

Language models can correct grammar and keep the style consistent across several emails. Attackers can also request different versions for different employees, such as an administrative notice for a human resources manager or a technical memo for an IT lead. Translation tools help an operator work across Korean and English without obvious language errors.

Code assistants can explain programming errors, suggest fixes, and generate examples. Misused in an attack, those functions can help less experienced operators assemble scripts and malware components more quickly. Combining coding support with writing and translation reduces the work needed to conduct a campaign across languages.

Identity creation adds another route into organizations. Models can help invent work histories, format resumes, and draft cover letters suited to job postings. Image tools can supply professional profile photographs that look plausible at a glance. Together, these capabilities support deception involving business email and attempts to remain inside an organization over a long period.

The military ID lure puts those capabilities into a concrete setting. The AI generated image supported the social engineering, while the archive, shortcut, scripts, and backdoor carried out the intrusion. The attack relied on both a believable story and a way to execute malicious code.

Verification and technical controls address different parts of the attack

South Korea has updated its National Cybersecurity Strategy with priorities including international cooperation, advanced technology, and stronger defenses. The plan highlights AI driven detection for monitoring in real time, closer information sharing with partners, and greater resilience across critical infrastructure.

Seoul has also pursued closer coordination with the United States and Japan to align policy and conduct joint exercises focused on responding to incidents. These efforts address the need to recognize attacks, exchange useful information, and respond when an intrusion occurs.

Inside an organization, verification begins with the request itself. Work involving credentials or identity documents should follow a documented process. An employee can check an unexpected request with a known official through a separate communication channel, instead of relying on the contact information supplied in the suspicious email.

Staff training should include checking domains letter by letter and examining a link's destination before clicking. In this campaign, the difference between .mil.kr and .mli.kr was small enough to escape a quick scan, yet central to the impersonation.

Technical controls address what happens when a deceptive message reaches an employee. Email gateways can quarantine nested archives and block risky attachments such as shortcut files, ISO disk images, and scripts. Restricting PowerShell where possible and allowing only approved applications to run can reduce opportunities for unauthorized code execution.

Endpoint detection and response tools monitor computers for suspicious activity, including malicious PowerShell calls and unusual outbound connections. Network monitoring can flag a new connection to an unfamiliar domain soon after a person interacts with an email. Those signals can help security teams identify an intrusion while the attacker is retrieving components or establishing access.

Hiring checks and AI safeguards face related pressures

Remote hiring and vendor screening have become part of cyber defense because false identities can give an operator legitimate access to an employer's systems. Strong identity checks can include live video, verification by a trusted third party, and references checked independently of the applicant.

Systems holding sensitive information should give people only the access needed for their work and continually verify that access. Routine audits can identify unusual login locations or activity outside expected working hours. These measures address the longer access sought through fraudulent employment as well as the access gained through malicious software.

AI developers face a related problem. The same tools that help employees draft documents, write code, and process images can assist adversaries. Developers have introduced systems that refuse harmful requests and monitor misuse, while attackers try to bypass those protections through carefully framed prompts.

Responses include sharing indicators of abuse, removing offending accounts, and adjusting model behavior to resist manipulation. Agencies and contractors can also require AI suppliers to provide audit logs, abuse reporting channels, and updates that strengthen model protections.

Corporate rules can reduce accidental creation of risky material. Security teams can test models against common jailbreak prompts and provide approved processes for legitimate work such as document design or code review. The ID card campaign illustrates why controls on AI output and controls on email attachments need to operate together: one addresses the convincing disguise, while the other addresses the route into the computer.

What to Know

• Kimsuky used AI generated military employee ID images in a targeted campaign detected in mid July 2025.
• The emails requested reviews of civilian staff badge designs and used domains such as .mli.kr to imitate .mil.kr.
• A detector gave one image a 98 percent probability of being AI generated; metadata in at least one sample referenced GPT 4o and ChatGPT.
• ZIP archives, a disguised shortcut, PowerShell commands, and a batch file named LhUdPC3G.bat featured in observed delivery chains.
• The malware enabled persistence, data theft, and remote control, and matched a family used in June ClickFix activity.
• Targets included a military related organization and researchers, journalists, and activists focused on North Korea.
• In August, an AI developer reported disrupting North Korean operators using its model for false identities and remote employment schemes.
• Independent verification, attachment restrictions, computer and network monitoring, and stronger hiring checks address different routes used by the attackers.