Kimsuky Builds a Local AI Stack With Three LLM Runtimes, RAG, and Attack Libraries

The evidence still lacks the denominator needed to show that AI has improved Kimsuky’s intrusion success: how many AI-made lures were sent, how many targets were infected, and how a campaign without AI performed. If security researchers later publish both conversion rates for comparable attack chains, tool-installation records can be connected to operational results. For now, the findings establish that the operator was assembling and testing an integration environment, not that AI made the attacks more successful.

On August 10, 2026, the Genians Security Center published its Operation GitPower investigation and linked a set of GitHub- and GitLab-based infrastructure to Kimsuky. Its logs contained three local LLM runtimes—Ollama, GPT4All, and Msty—as well as GPT4All’s localdocs_v3.db, an artifact created when its document-retrieval feature is configured. Reuters independently reported the findings on the same date. Genians described the activity as a continuation of a campaign it had followed for years, rather than a wholly new intrusion method.

From a lure document to Git-based command and control

The observed chain began with a malicious LNK file inside a ZIP archive. When a recipient opened a shortcut disguised as an official letter, research document, or investment report, roughly 3,800 characters of PowerShell decoded and launched later scripts. The scripts used GitHub Raw Content and APIs to display a benign PDF, collect system details, and retrieve encrypted payloads. Some files with .png names were actually RC4-encrypted .NET AsyncRAT payloads, and a hard-coded GitHub token seen by the researchers has since been revoked.

Generative AI had a narrower demonstrated role than the broadest headlines suggest. Genians found lure documents whose metadata, structure, and repeated layout were consistent with automated generation, along with Cursor records used while testing GitHub command and control. The report did not show an AI agent selecting targets or autonomously completing the full intrusion chain. That distinction matters because a polished phishing document and an autonomous offensive system create very different operational risks.

Three runtimes leave different evidence

Ollama’s directory contained keys that support prior execution, GPT4All left its LocalDocs database, and Msty left an installer and local-service files. Researchers also found LLaMaSharp, Microsoft.SemanticKernel, Microsoft.Agents.AI, Whisper, and GPU backends. Together, those components cover document retrieval, agent workflows, speech transcription, and C# integration. Their presence supports the conclusion that the operator compared several existing models and frameworks, but it does not establish that every component reached a live campaign.

Attribution has limits as well. The logs included an “Arirang” device manufacturer string, North Korean vocabulary, Korean keyboard traces, and Cursor activity associated with a GitHub C2 test. Genians combined those clues with infrastructure and techniques it had tracked over time to assess a Kimsuky connection. The report explicitly cautioned that one device name or linguistic clue cannot establish the operator’s identity by itself.

Most importantly, investigators found no large training dataset, fine-tuning output, or newly trained model weights. The evidence therefore supports integration of existing AI, RAG, and agent libraries, not the claim that Kimsuky trained its own attack model. Reuters provided independent reporting on the central finding, while the technical details and attribution assessment originate with Genians.

Over the next three to six months, two measurable results would clarify the operational effect: the number of lure variants derived from the same document template and the share of linked LNK, hidden PowerShell, and Git API behavior blocked by endpoint defenses. If later samples still show only installed tools and study material, this remains capability preparation. Evidence that RAG automatically triaged stolen documents or that an agent produced reproducible new attack steps would support the stronger conclusion of operational AI integration.

Sources:

• Genians Security Center: AI를 공격 체계에 접목하는 김수키, 미끼 문서 제작부터 로컬 LLM 구축까지
• Reuters: North Korean hacking group builds AI tools for cyberattacks, report says