"Provide concrete evidence that the Kimsuky-affiliated threat actor is moving beyond one-off experimentation with AI and is continuously preparing to integrate the technology into actual attack capabilities, including malware development, data analysis, and the advancement of attack techniques," Genians researchers wrote.
Kimsuky’s move to local LLM environments
South Korean security firm Genians reports that Kimsuky, a cyber-espionage crew operating under North Korea’s Reconnaissance General Bureau, has set up and operated local large language model (LLM) environments on infrastructure it controls. The researchers observed the group installing and using Ollama, GPT4All, and Msty, while also experimenting with other AI tools such as Cursor. Genians noted that the actors preferred a local approach because “the local approach prevents conversation data from being transmitted to external AI services,” reducing the risk of external exposure.
How AI is being applied to attack tradecraft
The investigation found Kimsuky using AI across several practical stages of intrusion: phishing lure generation, code editing, automated document search via retrieval-augmented generation (RAG), and logs showing speech-to-text tools. Genians uncovered evidence of Cursor AI being used to edit code, tests of RAG for document-based question answering, and logs referencing OpenAI’s Whisper speech recognition models. The researchers saw collections of libraries and packages — including LLaMaSharp, Microsoft.Extensions.AI, and connectors such as OpenAI and Azure.AI.OpenAI — that span “local AI execution → document retrieval (RAG) → automated agents → external AI integration.” Genians concluded that assembling these components “strongly suggests” the group collected them for the direct development of an AI-based tool for a specific purpose.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePhishing, LNK loaders and the mechanics of compromise
Genians described the recent Kimsuky campaign mechanics in detail. Phishing emails carried ZIP archives with malicious LNK shortcut files disguised as materials about international events, research reports, or meeting requests. When recipients open the archive and execute the LNK, the shortcut runs an embedded PowerShell loader. In some instances, the lure content itself was created with AI and focused on virtual assets and finance.
The decoy documents were designed to maximize trust and execution: they “use natural language, a highly polished structure, and formats similar to actual business materials to increase user trust and induce the execution of malicious files.” Kimsuky also used obfuscation techniques such as Base64 encoding, string splitting, and custom decoding routines to conceal malicious behavior.
Once executed, the PowerShell script collects extensive system information — operating system version and architecture, system configuration, PC type, operating system installation and boot history, and a list of running processes — data the attackers use to assess environments and plan follow-on activity.
Git-based command-and-control, development and testing
Genians’ months-long analysis found multiple public GitHub repositories operated by the threat actor. One repository contained configuration files, PowerShell scripts, and “various payloads used in subsequent attacks.” The researchers also observed the use of Git-based C2 infrastructure for malware development and testing, stolen data management, and AI technology research — tying the toolchain and operational artifacts together on platforms the actors control.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: The report pushes defenders away from content-based heuristics. Because AI-generated decoys can produce polished, natural-language documents, Genians recommends shifting to behavior-based detection — watch for post-LNK execution behaviors such as PowerShell activity, persistence establishment, and external communications as more reliable indicators of compromise.
- Policymakers and regulators: The use of local LLM deployments and commercial integration libraries (OpenAI, Azure.AI.OpenAI) demonstrates how state-affiliated actors can mix open-source and commercial components to scale tradecraft. That convergence presents a policy challenge about visibility and control over supply-chain and model-integration components used in offensive operations.
- Affected enterprises and procurement leaders: Organizations that rely on file-format and content-similarity checks for threat triage should reassess those controls. Genians’ findings show attackers increasingly depend on RAG and automated agents to extract value from stolen files, raising the urgency of monitoring anomalous retrieval and exfiltration behaviors alongside conventional IoCs.
Genians stressed that, while its analysts did not find evidence that Kimsuky had begun training their own models, the combination of local LLM setups, document-retrieval testing, automated coding tools, and external-AI integration components paints a picture of sustained development rather than casual experimentation. The practical takeaway is straightforward: polished decoys alone no longer prove innocence, and defenders must focus on the actions that follow a click.
