Intelligence Brief
Genians Security Center found evidence that North Korea-linked threat group Kimsuky built local artificial intelligence environments using Ollama, GPT4All and Msty. Researchers assessed that the group is accumulating tools and knowledge that could support broader attack operations.
The activity formed part of an existing campaign rather than a newly launched operation. Genians connected it with previous Kimsuky tactics, including PowerShell execution, malicious shortcut files and the use of GitHub or GitLab infrastructure to distribute encrypted AsyncRAT payloads.
Virtual asset organisations remain among the group’s targets. Researchers also identified polished documents about investment services and cryptocurrency that appeared designed for social engineering. Some files contained linguistic indicators associated with North Korea.
Local models are operationally useful because prompts, malware code and campaign information can remain inside infrastructure controlled by the attacker. That reduces the risk of sensitive activity appearing in an external model provider’s logs.
Strategic Assessment
The immediate threat is not an autonomous AI attack system. The evidence instead points to Kimsuky testing how local models can improve research, document production, coding and campaign preparation.
That distinction matters. AI can lower the effort required to produce convincing Korean or English material, modify scripts and create multiple versions of a phishing lure. It does not remove the need for access, delivery infrastructure or successful victim interaction.
Crypto businesses, custodians and investment teams carry the exposure because staff regularly receive documents involving token projects, partnerships and financial services. Behaviour based endpoint monitoring is more useful than relying only on known file signatures, particularly where attackers change scripts frequently.
