Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development
Summary: South Korean security firm Genians says it found North Korea's Kimsuky group running AI offline on its own servers, with the tools Ollama, GPT4All and Msty present on infrastructure linked to the unit, and Ollama having generated its first-launch keys while GPT4All carried a configured localdocs_v3.db for its LocalDocs retrieval-augmented generation feature. The firm also recovered developer libraries LLaMaSharp, Microsoft's Semantic Kernel and Microsoft.Agents.AI, OpenAI Whisper speech-to-text files with a guide on extracting text from audio, and traces of the Cursor coding editor, but found no evidence the group trained its own model and no evidence the offline stack has been run against a victim.
Why it matters: Genians describes an actor in a research and knowledge-acquisition stage, and the report could not confirm the recovered operator request to check a data set for wallet details, Gmail credentials and site-registration history was ever submitted to an AI service - so the near-term change is narrower than the 'AI attack tools' label implies. The concrete stake is the detection tell: once AI writes the bait, stilted translation, clumsy formatting and spelling mistakes weaken, leaving defenders to correlate LNK execution, PowerShell, hidden scheduled tasks and GitHub traffic instead of judging a lure by how polished it looks.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026