Kimsuky Sets Up Local LLM Environment as AI Attack Capabilities Grow

On Aug. 10, cybersecurity firm Genians disclosed that Kimsuky, a hacking group tied to North Korea's Reconnaissance General Bureau, has expanded its use of generative AI. The group now runs a standalone local large language model (LLM) environment and a retrieval-augmented generation (RAG) system, moving beyond earlier work that used AI mainly to craft phishing lures. According to Yonhap, the tools involved include local LLM managers Ollama, GPT4All and Msty, along with the AI code editor Cursor. Genians said the shift points to an intent to automate intelligence extraction and attack workflows. The public disclosure ties the upgrade to Kimsuky's broader mission of gathering intelligence and running cyber operations. Building a local AI stack means the group can generate text and process technical information without leaning on commercial cloud services. The reported use of RAG also suggests an effort to pull data from a private knowledge base and turn it into usable output. No further details about the group's infrastructure were included in the announcement.