Case openai-kimsuky-bluenoroff-rdpState actor AI opsWorldwide
Kimsuky and BlueNoroff used ChatGPT to debug RDP brute-force code and research intrusion
OpenAI banned accounts linked to North Korea's Kimsuky and BlueNoroff that gathered information on cyber intrusion tools and cryptocurrency topics and debugged code for RDP brute-force attacks.
MediumAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Feb 21, 2025
- Location
- Worldwide
- Target
- Cryptocurrency and intrusion targets of North Korean groups
- Severity
- Medium
- Triggered by
- Kimsuky and BlueNoroff (North Korea)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
OpenAI banned accounts linked to North Korea's Kimsuky and BlueNoroff that gathered information on cyber intrusion tools and cryptocurrency topics and debugged code for RDP brute-force attacks.
Impact: Incremental productivity uplift; no novel capability observed.
Who triggered it
Actor: Kimsuky and BlueNoroff (North Korea)
Attribution: OpenAI attributed the accounts to the two DPRK groups with industry-partner input.
Motive: Espionage and cryptocurrency theft
How it happened
Attack vector: ChatGPT used for tool research and debugging of brute-force code
Root cause: Low-level coding help provided to accounts later tied to state actors
Timeline
- OpenAI publishes the cyber threat actor case and bans the accounts
- OpenAI June 2025 report reiterates DPRK cyber actor activity
Response
Accounts banned, indicators shared with partners.
Current status: Contained
Sources (open in a new tab)
- OpenAI February 2025 report PDF cdn.openai.com
- AI Incident Database report incidentdatabase.ai
Cite this case
Kimsuky and BlueNoroff used ChatGPT to debug RDP brute-force code and research intrusion. AI Threat Watch, case openai-kimsuky-bluenoroff-rdp, Feb 21, 2025. https://aithreat.io/cases/openai-kimsuky-bluenoroff-rdp/
Permanent link: https://aithreat.io/cases/openai-kimsuky-bluenoroff-rdp/