North Korea’s Kimsuky hacking unit — a long-running espionage group under the country’s Reconnaissance General Bureau — is no longer just experimenting with public AI chatbots. South Korean security firm Genians has documented a local AI stack assembled on infrastructure linked to Kimsuky: the offline language-model runners Ollama, GPT4All, and Msty, each of them configured and used rather than merely downloaded. The group also set up a GPT4All retrieval-augmented generation database (LocalDocs), which connects a language model to a private collection of documents — the kind of setup that lets an intelligence unit query its own stolen files as if prompting a search engine.
Beyond the ready-made tools, Genians found developer libraries including LLaMaSharp, Microsoft’s Semantic Kernel, and Microsoft.Agents.AI on the same infrastructure. These are building blocks for embedding AI into custom software, and they sit alongside OpenAI’s Whisper speech-to-text tool and Cursor, an AI-assisted coding editor. The picture is a group in a deliberate “research and knowledge acquisition” phase: testing existing components and working out how to fold AI into every stage of an operation, from writing phishing lures to analyzing collected data and building malware. This connects to an ongoing campaign Genians calls Operation GitPower, which uses GitHub repositories as command channels in an LNK-to-PowerShell infection chain.
The practical consequence for defenders is a meaningful reduction in the tells that make social-engineering attacks identifiable. When an AI system writes the phishing email, stilted grammar, awkward translation, and telltale formatting errors disappear. Genians advises defenders to shift focus to what an intrusion does on the machine — LNK execution, PowerShell activity, hidden scheduled tasks, GitHub traffic, and encrypted payload drops — rather than judging a lure primarily by how natural the writing looks.
Sources
- The Hacker News — Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development
- Genians Security Center (primary research)