Inside Lazarus: How North Korea uses AI to industrialize attacks on developers

Expel has identified a North Korean state-sponsored APT group (HexagonalRodent) conducting industrial-scale attacks on developers, exfiltrating approximately $12 million in cryptocurrency over three months. The group extensively abuses generative AI tools including Cursor and ChatGPT to automate social engineering and malware delivery via fake job offers and backdoored coding assessments. The campaign demonstrates significant state-level adoption of AI for offensive cyberattacks and includes a rare supply chain attack on the fast-draft VSCode extension.