Students and members of the public read in a library at the Grand People’s Study House near Kim Il-Sung Square in Pyongyang, capital of North Korea in April 2011.
AFP via Getty Images
North Korea’s most prolific cyber-espionage unit has built a private artificial intelligence laboratory inside its own attack infrastructure — installing open-source large language model tools on the same servers it uses to receive stolen data and issue attack commands, then pointing them at classified documents, diplomatic correspondence, and virtual-asset credentials without ever sending that material to an external AI provider. The finding, published August 10, 2026, by South Korean cybersecurity firm Genians Security Center, represents the first documented case of a state-sponsored APT group constructing a self-hosted LLM environment for operational use, as confirmed in the full technical report. The immediate defensive implication is direct and uncomfortable: any security team that still uses grammatical errors, poor formatting, or unnatural translated language as primary signals for identifying malicious emails is relying on a detection method that AI has now made obsolete.
The group responsible is Kimsuky — also tracked as APT43, Emerald Sleet, and Velvet Chollima — which has operated since at least 2012 under North Korea’s Reconnaissance General Bureau, the regime’s primary foreign intelligence service. The US Treasury sanctioned Kimsuky in November 2023, coordinated with Australia, Japan, and South Korea, describing it as “primarily an intelligence collection entity” whose cyber espionage campaigns directly support the DPRK’s strategic and nuclear ambitions. Genians has named the current campaign Operation GitPower.
Kimsuky Built Its Own Offline AI Lab — Here Is What That Means
The strategic rationale for building a local AI environment is simple: an intelligence agency that routes stolen diplomatic cables or classified research through a commercial AI service like ChatGPT or Claude is creating an evidence trail and risking exposure of that material. A self-hosted system, running entirely on the attacker’s own hardware, eliminates that risk. The stolen documents never leave Kimsuky’s servers.
What Genians found inside Kimsuky’s command-and-control (C2) infrastructure was not a single tool downloaded and discarded. It was a systematic evaluation of multiple local LLM platforms, followed by active configuration for operational use, all documented with forensic precision.
The first platform was Ollama, a free, open-source tool for running large language models — including Meta’s Llama, Mistral AI’s Mistral, Google’s Gemma, and DeepSeek — entirely on local hardware without an internet connection. Investigators found the unique SSH authentication key files that Ollama automatically generates only when it is first launched, confirming the software was not merely downloaded but actually installed and executed.
The second was GPT4All, developed by Nomic AI, which supports a feature called LocalDocs — a retrieval-augmented generation (RAG) system that allows an AI to answer questions using a library of user-provided documents rather than relying solely on training data. Investigators found the localdocs_v3.db database file, which is created only when LocalDocs is configured, confirming that the operators had attempted to feed documents in their possession into the AI system and use them as knowledge source.
The third was Msty, an AI desktop application that can integrate local LLM engines such as Ollama with cloud AI services including ChatGPT, Claude, and Gemini, and provides AI agent configuration, RAG over documents, and integration with external tools through the Model Context Protocol. Genians identified installation traces for all three platforms.
“The fact that all three tools left installation traces is an important indicator that the threat actor did not merely test a single tool by chance, but broadly compared and evaluated multiple approaches to running AI models locally,” Genians said.
The operational significance of RAG specifically deserves direct explanation. Traditional data theft creates a collection problem: a team of human analysts must manually review thousands of stolen files to find anything actionable. RAG transforms that into an intelligence problem solvable at machine speed. The question “what do these 10,000 stolen files say about the target’s position on missile development?” — previously a weeks-long human task — becomes a seconds-long AI query against an indexed local knowledge base. Genians confirmed that the localdocs database had been configured, meaning someone had actually indexed a document corpus against the AI system, not merely installed the capability.
Why Kimsuky Chose Local AI: State Actors Can Afford What Criminal Actors Cannot
This is where the Kimsuky finding differs from the broader picture of criminal actors experimenting with self-hosted AI. Check Point Research, in its January-February 2026 AI Threat Landscape digest, documented a growing but frustrated ecosystem of cybercriminals attempting to run local LLMs: self-hosted models consistently showed a gap between aspiration and capability, with community discussions revealing that local models hallucinated frequently and commercial models outperformed local alternatives for offensive tasks. One active criminal tools vendor concluded that local deployment was currently more of a burden than something productive.
Kimsuky is not a criminal actor optimizing for profit. As an intelligence unit with state backing, it has two advantages that criminal actors lack: the engineering budget to build a functional local AI stack regardless of short-term operational productivity, and the OPSEC mandate to accept that burden. An intelligence agency processing stolen diplomatic cables cannot afford to let those cables touch commercial AI infrastructure. The state-sponsored constraint creates a different optimization function — one that points toward local deployment even when local models underperform commercial alternatives.
The NuGet packages Genians found on Kimsuky’s infrastructure make this assessment concrete. Hidden in a Pictureszzznupkg directory unlikely to attract attention, investigators found LLaMaSharp (a library for running LLMs in C# applications), GPU acceleration backends for CUDA 11 and CUDA 12, LangChain providers, Microsoft.SemanticKernel, Microsoft.Agents.AI, Microsoft.Extensions.AI, and both OpenAI and Azure.AI.OpenAI packages. These are not random downloads. They represent the complete development stack for a pipeline running from local LLM execution through RAG document retrieval to autonomous multi-step AI agents integrated with external commercial services. “The fact that development components spanning ‘local AI execution → document retrieval (RAG) → automated agents → external AI integration’ were collected together strongly suggests that they were not gathered out of simple curiosity,” Genians stated, “but for the direct development of an AI-based tool designed for a specific purpose.”
Critically, Genians is careful about what it is and is not claiming. No large training datasets were found, no model outputs from fine-tuning runs, and no evidence of independent model training. The observed activity “remains focused on learning and experimenting with ways to integrate publicly available AI models and frameworks into its own tools and programming environment, primarily C# and .NET.” Kimsuky is not building AI from scratch. It is assembling an operational pipeline on top of models others have built — and that distinction matters less than it might seem, because the most dangerous capability (RAG over stolen documents, AI agents automating multi-step intelligence tasks) does not require custom models to be operational.
AI-Powered Phishing: Why Content-Quality Detection Is Now a Broken Signal
The three most dangerous capability combinations Genians flags for future threat evolution are: RAG applied to stolen documents, speech-to-text applied to stolen audio, and AI agent frameworks integrated with Kimsuky’s C# and .NET malware development environment. The second of these deserves attention. The infrastructure contained both OpenAI’s Whisper speech recognition model and faster-whisper, its accelerated open-source implementation, alongside a Korean-language training file titled roughly “Let’s extract text from audio files (with faster whisper).” Stolen audio recordings from compromised systems — intercepted calls, meeting recordings, captured microphone data — can now be converted to searchable, indexable text automatically, eliminating the transcription bottleneck that previously limited audio intelligence at scale.
But the shift that most directly affects the largest number of defenders right now is the AI-generated phishing lures. Kimsuky has historically reused documents stolen in earlier attacks as bait in subsequent campaigns. Since early 2026, that practice has been supplemented by what appears to be a fully automated document-generation pipeline using generative AI, as documented with forensic metadata evidence.
The forensic evidence is in the PDF metadata. Two English-language decoy documents listed python-docx as the Author field — a widely used Python library for programmatically generating Microsoft Word documents — alongside WPS Office’s word processor as the Creator. Both documents were found to have identical creation and modification timestamps: 5:00:04 a.m. on March 11, 2026, and 5:00:44 a.m. on March 24, 2026, respectively. Creation and modification timestamps 40 seconds apart, across documents produced two weeks apart, at 5:00 a.m. — these are the fingerprints of an automated script running on a schedule, producing multiple documents in under a minute.
“This change goes beyond a shift in how decoy documents are created and demonstrates that AI can enable the automation and large-scale production of social engineering attacks,” Genians said. The documents covered different topics — virtual assets, financial investment, game development — but shared a high degree of similarity in their structure and writing style, and visual patterns (consistent layouts, emoji in headers, table structures, margins) that closely resembled the default templates of recent generative AI-based document creation services.
The implication for defenders is direct. The traditional triage heuristics — “does this email contain grammatical errors consistent with non-native translation?”, “does the formatting look off?”, “does the document structure seem automated?” — were already weakening before this report. Kimsuky’s automated production pipeline shows that these signals are no longer reliable at all as primary detection criteria.
“Assessing threats based solely on the quality of decoy documents is no longer an effective defensive approach,” Genians stated. “The use of generative AI is rapidly weakening traditional digital profiling indicators, such as unnatural translated language, poor formatting, and spelling errors. Defensive strategies must therefore shift from content-based assessment to behavior-based detection.”
GitHub as the Spy’s Command Post: RC4-Encrypted Trojans Disguised as Animal Photos
The campaign’s delivery mechanism is as technically notable as its AI infrastructure. Kimsuky abused public GitHub repositories as both C2 infrastructure and payload distribution channels, storing RC4-encrypted AsyncRAT payloads inside files named apple.png, rabbit.png, fox.png, lion.png, and wolf.png. These files are not images — analysis confirmed they contain no image data — but the filenames and extensions allow them to pass casual inspection.
When a target executes a malicious LNK shortcut file from a ZIP archive, an obfuscated PowerShell script runs silently: it downloads a legitimate-looking decoy document from GitHub to display to the victim while registering a hidden scheduled task that contacts the attacker’s GitHub repository every 30 minutes. The attacker can update payloads simply by pushing new commits. The request header includes a hardcoded GitHub personal access token (PAT) for API access — the one found by Genians has since been revoked.
The group also used Cursor AI, the AI-assisted code editor, to edit and test files related to its C2 infrastructure, including testing the GitHub command-and-control upload functionality in what amounted to live operational debugging of its own hacking tools.
How Investigators Confirmed This Is North Korea
Attribution rests on multiple layers of evidence beyond technical indicators. The system manufacturer listed in the threat actor’s logs was “Arirang” — a brand not known as a PC manufacturer in South Korea, but documented as a North Korean tablet PC and smartphone brand. The machine ran Astrill VPN, a client repeatedly identified in threat intelligence reports as an indicator associated with North Korean operators, including the DPRK IT worker infiltration campaigns documented by the FBI and eleven allied governments in recent months.
Most definitively, Genians reconstructed Korean-language text from keystroke logs by converting English key values through the South Korean Dubeolsik keyboard layout. The recovered sentences contained vocabulary and spelling that deviate systematically from South Korean conventions: “싸이트” (site), “리력” (history), and “로출되였는지” (whether it was exposed) — spelling patterns characteristic of North Korean usage, where the standard South Korean equivalents would be “사이트,” “이력,” and “노출되었는지.” “The same spellings were retained even after repeated corrections using the Backspace key,” Genians noted, “indicating that they were not simple typographical errors but rather spelling habits internalized by the threat actor.”
One reconstructed prompt submitted to an AI service — translated into English via Google Translate first — asked whether personal information, including wallet credentials, Gmail account details, and website registration histories, had been exposed in the analyzed data. The structure and content are consistent with an operator analyzing data harvested from compromised targets.
What Can Organizations That Are Targeted Do Right Now?
The behavioral indicators Genians identified for this campaign are specific enough to build detection rules around. Defenders should look for the following sequence as a unified attack context rather than isolated anomalies:
The initial execution chain: abnormally long command-line arguments in LNK files (the campaign example contained approximately 3,800 characters), followed by a hidden PowerShell process executing a custom Base64 decoder, followed by a legitimate PDF opening while malicious activity continues in the background.
The persistence and C2 pattern: PowerShell scripts written to the AppData or Temp directory with randomized names; a scheduled task that runs every 30 minutes; outbound connections to GitHub’s Raw Content API using personal access tokens with no legitimate business association; downloads of files with image extensions (*.png) that are actually RC4-encrypted .NET binaries.
For organizations that operate in the specific sectors Kimsuky targets — policy research, academic institutions, diplomatic missions, financial services with exposure to virtual assets, and military or security-adjacent organizations — the defense recommendation is straightforward and urgently needed: move threat triage off content-quality signals and onto behavioral chain correlation. A document that reads flawlessly is no longer evidence of legitimacy. A document that triggers a hidden PowerShell process, writes a scheduled task, and beacons to GitHub still is evidence of compromise — and that behavioral chain is detectable regardless of how polished the initial lure looks.
“In addition to indicator of compromise (IoC)-based detection,” Genians said, “organizations should contextually correlate the sequence of anomalous activities following LNK execution — including PowerShell execution, persistence establishment, and external communications — to assess the overall threat level.”
Frequently Asked QuestionsHow can Kimsuky use RAG with stolen documents, and why does that matter?
Retrieval-augmented generation (RAG) is a technique in which an AI system, before answering a question, searches a library of specific documents for relevant passages and uses those passages as context for its response. GPT4All’s LocalDocs feature implements this using a locally stored vector database. For Kimsuky, that library is the stolen documents the group has accumulated from compromised targets. Instead of requiring a human analyst to manually review thousands of files to find actionable intelligence, a RAG-equipped AI can answer natural-language queries — “who are the named contacts in these embassy communications?” — in seconds. Genians confirmed the localdocs database had been actively configured, meaning this was not theoretical capability but operational use.
What replaced grammatical errors as a way to detect AI-generated phishing emails?
The shift Genians documents is not that there is a perfect new signal — it is that content-quality signals (errors, formatting anomalies, unnatural language) can no longer be relied upon as primary triage criteria, because AI generation eliminates them at scale. The detection approach that remains reliable is behavioral: what does the file do when executed? The Kimsuky campaign’s behavioral signature — LNK execution triggering a hidden PowerShell loader, a scheduled task writing scripts to AppData, and periodic connections to GitHub’s Raw Content API — does not change regardless of how polished the decoy document looks. Endpoint detection and response (EDR) tools configured to correlate this behavioral chain can catch the attack even when the lure is indistinguishable from a legitimate document.
Does Kimsuky’s local AI lab mean the group is now training its own AI models?
No. Genians explicitly found no evidence of independent model training — no large training datasets, no fine-tuned model outputs, nothing indicating the group is building AI from scratch. Kimsuky’s approach is integration, not invention: running publicly available open-weight models (Meta’s Llama, Mistral, Google’s Gemma) locally through platforms like Ollama, and building tools in C# and .NET that call those models through frameworks like LangChain and Microsoft.SemanticKernel. The training gap compared to frontier commercial models does not reduce the operational threat from RAG and agent automation, which do not require custom training to be functional.
What specific sectors are most at risk from Operation GitPower?
Genians documents Operation GitPower as targeting policy, academic, diplomatic, international-cooperation, and security-related organizations through spear-phishing, with attack lures imitating international event materials, embassy correspondence, honorarium payment requests, legal documents, and financial investment materials. Virtual asset and cryptocurrency organizations have also been targeted, consistent with Kimsuky’s documented expansion into financial intelligence collection. Organizations in these sectors — particularly those handling North Korea-related policy, Korean Peninsula security research, or high-value cryptocurrency positions — should treat this report as a direct, current threat to their operations, not a research finding about someone else’s problem.