In the latest attack, the group used deepfakes of South Korean military identification documents to attempt to convince targets — including journalists, researchers, and human-rights activists — to click on a link, according to an analysis published Sept. 15 by Genians, a South Korean cybersecurity firm. Related:Innovative FileFix Phishing Attack Proves Plenty PotentThe fake South Korean military ID with metadata showing that it is AI-generated. North Korean groups have frequently created fake identities documents for operatives posing as IT workers as part of the massive operation to embed North Korean technical experts inside Western companies. "The military ID does give off a level of authority, even though a different lure could have been used to accomplish the attack," he says. The threat researchers connected Kimsuky to the attacks through correlating specific threat indicators, including IP addresses and specific malware, and finding interconnections to the North Korean nation-state group.