Case kimsuky-chatgpt-military-idState actor AI opsSouth Korea
Kimsuky uses ChatGPT-forged South Korean military ID in spear-phishing
Genians found North Korea's Kimsuky attached AI-generated deepfake military ID drafts to phishing emails that dropped malware on researchers, activists and journalists.
MediumAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 15, 2025
- Location
- South Korea
- Target
- South Korean defense-related researchers
- Severity
- Medium
- Triggered by
- Kimsuky (North Korean state-sponsored, aka APT43)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Genians found North Korea's Kimsuky attached AI-generated deepfake military ID drafts to phishing emails that dropped malware on researchers, activists and journalists.
Impact: Malware delivered to defence-related researchers, activists and journalists in South Korea; number of successful infections not disclosed
Who triggered it
Actor: Kimsuky (North Korean state-sponsored, aka APT43)
Attribution: Attributed by Genians Security Center based on infrastructure and tooling overlap with known Kimsuky campaigns
Motive: Espionage against South Korean defence, research, activist and journalist targets
How it happened
Attack vector: Spear-phishing from a spoofed defence domain with Government_ID_Draft.zip whose shortcut ran obfuscated PowerShell to fetch malware and a ChatGPT-generated fake military ID image
Root cause: Image-generation guardrails bypassed by framing prompts as legitimate sample designs; targets trusted an official-looking ID lure
Timeline
- Phishing emails with deepfake military ID attachment sent to South Korean targets
- Genians publishes analysis attributing the campaign to Kimsuky; The Record and The Register report it
Response
Genians published IOCs and detection guidance; no public response from OpenAI specific to this campaign
Current status: Ongoing
Sources (open in a new tab)
- The Record therecord.media
- Genians genians.com
- The Register theregister.com
Cite this case
Kimsuky uses ChatGPT-forged South Korean military ID in spear-phishing. AI Threat Watch, case kimsuky-chatgpt-military-id, Sep 15, 2025. https://aithreat.io/cases/kimsuky-chatgpt-military-id/
Permanent link: https://aithreat.io/cases/kimsuky-chatgpt-military-id/