Ledger / 7 Oct 2025
Korean-language operators sought ChatGPT help for malware and C2
Strong
OpenAI banned the accounts but does not independently attribute to DPRK.
The cluster used ChatGPT for malware and C2 development and Korean phishing drafts, overlapping Trellix reporting on XenoRAT.
“operators attempted to use our models to engage in malware and command-and-control (C2) development”OpenAI
Sources
- Disrupting malicious uses of AI: October 2025 (report PDF)OpenAI · 7 Oct 2025 · primary source
- Disclosed
- 7 Oct 2025
- Activity
- 2025
- Actor
- Korean-language operator cluster (overlaps Trellix reporting) (unknown), as attributed by OpenAI
- Nexus
- North Korea (suspected)
- Targets
- South Korean diplomatic missions
- What the AI did
- Malware dev, Phishing content
- Model
- ChatGPT
- Model family
- OpenAI
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Accounts banned; OpenAI could not independently attribute.