North Korean spies are running local LLMs to cause AI mischief

1. Executive summary

North Korean state-sponsored actor Kimsuky (MITRE G0094) is operating local large language model (LLM) environments and integrating AI capabilities into its attack lifecycle, according to research published by South Korean security firm Genians. The group is using Ollama, GPT4All, and Msty to run local LLMs, and retrieval-augmented generation (RAG) to automate document search over stolen files — enabling faster identification of valuable data. Kimsuky continues to target government agencies, think tanks, academia, and security research organisations using AI-enhanced phishing lures delivered via ZIP archives containing malicious LNK files that execute embedded PowerShell loaders, with command-and-control (C2) conducted through public GitHub repositories. EMEA financial services organisations are exposed as the group has demonstrated interest in virtual assets and finance-themed lures; the use of AI to produce polished, convincing decoy documents undermines traditional content-based phishing detection.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. While Kimsuky's targeting of financial services and use of AI-enhanced social engineering is operationally relevant, the activity described is a threat-intelligence development — adversary tooling and tradecraft evolution — rather than a specific ICT incident at a regulated entity or a supply-chain compromise triggering incident management or reporting obligations. Clients should track this as threat context for risk assessment under DORA Art. 24 (digital operational resilience testing — general requirements) if they choose to use it to inform red-team scenario design, but no article is specifically triggered by the facts presented.

3. Technical analysis & attack chain

Attribution to Kimsuky is confirmed via MITRE ATT&CK profile G0094. The actor operates under North Korea's Reconnaissance General Bureau. The technical detail below is drawn from Genians' research as reported by The Register and The Hacker News; this is a single-sourced vendor report — verify before enforcement.

Attack chain

1. Initial access — Phishing with AI-enhanced lures. Kimsuky sends phishing emails containing ZIP archives with malicious LNK files, disguised as materials related to international events, research reports, or meeting requests. The group has used AI to create lures related to virtual assets and finance. These decoy documents use natural language, polished structure, and formats similar to actual business materials to increase victim trust.
2. Execution — LNK → PowerShell loader. When the recipient opens the archive and executes the LNK file, the shortcut runs an embedded PowerShell loader.
3. Obfuscation. The PowerShell scripts use Base64 encoding, string splitting, and custom decoding routines to hide malicious behaviour.
4. Discovery — System information collection. The PowerShell script collects: operating system version and architecture; system configuration; PC type; OS installation and boot history; list of running processes. This information is used to assess the infected environment and support follow-on attacks.
5. Command and control — Git repositories. The intrusion uses public GitHub repositories for C2 infrastructure. Genians identified multiple public GitHub repositories operated by the threat actor. One repository contained configuration files, PowerShell scripts, and various payloads used in subsequent attacks. The Git-based C2 infrastructure is also used for malware development and testing, stolen data management, and AI technology research.
6. AI integration — Local LLM environments. Kimsuky set up multiple local LLM environments using Ollama, GPT4All, and Msty on infrastructure it controls. This prevents conversation data from being transmitted to external AI services, reducing the risk of external exposure. The group tested RAG for document-based question answering, which can accelerate identification of valuable information within large volumes of stolen files.
7. AI tool collection. The actors collected a large number of libraries and packages, including: LLaMaSharp, Microsoft.Extensions.AI, OpenAI, Azure.AI.OpenAI. These span the chain of "local AI execution → document retrieval (RAG) → automated agents → external AI integration," suggesting purpose-built AI tooling development. Logs also revealed speech-to-text tools (OpenAI Whisper speech recognition models) and evidence of Cursor AI for code editing.

Unconfirmed claims: Genians stated they did not find evidence that Kimsuky has begun training its own models; the group remains focused on applying existing AI to malware development and attack operations. No evidence of model training was presented.

4. Mitigation & containment

P1 — Within 24 hours

• Block LNK execution from email-delivered archives. Configure email gateways to strip or quarantine ZIP archives containing LNK files. Deploy endpoint rules to block execution of LNK files originating from email clients or archive extraction directories.
• Hunt for Git-based C2. Search endpoint logs for git.exe or git CLI activity originating from unexpected user contexts, especially PowerShell-spawned git processes. Review outbound traffic to github.com from non-developer workstations. Identify any systems pulling from public GitHub repositories associated with unusual user accounts.
• Detect PowerShell loader patterns. Configure EDR to alert on PowerShell execution spawned from explorer.exe or lnk file invocation, particularly involving Base64-encoded commands (-EncodedCommand or -e flags) and string-splitting obfuscation patterns.

P2 — Within 72 hours

• Behaviour-based detection shift. Move from content-based phishing assessment (looking for poor translation, formatting errors, spelling mistakes) to behaviour-based detection. AI-generated lures will not exhibit these traditional indicators. Focus detection on post-execution behaviour: PowerShell execution following LNK file opening, persistence establishment, and external communications to GitHub.
• Hunt for local LLM tooling on corporate endpoints. Search for presence of Ollama, GPT4All, Msty, LLaMaSharp, Microsoft.Extensions.AI, OpenAI, Azure.AI.OpenAI packages, and Cursor AI on corporate systems. While these are legitimate tools, their presence on non-developer endpoints or in conjunction with suspicious PowerShell activity warrants investigation.
• Review GitHub repository access. Audit corporate GitHub access and identify any repositories being used for purposes inconsistent with legitimate development activity.

P3 — Within 7 days

• Update phishing awareness training. Brief users that AI-generated lures will appear polished and professional; traditional tell-tale signs of phishing (poor grammar, awkward formatting) are no longer reliable. Emphasise verification of unexpected attachments and meeting requests.
• Threat-hunt for Kimsuky TTPs. Search historical logs for the attack chain: LNK execution → PowerShell with Base64 → system information collection commands → git-based network activity. Focus on systems used by staff in government relations, policy research, or security research roles.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, email addresses) are present in the source material. The sources describe observable behaviours and tooling but do not publish specific IOCs.

Behavioural indicators

6. Detection

rule Kimsuky_AI_Stack_Packages {
    meta:
        author = "Adverse Trace"
        date = "2026-08-10"
        reference = "https://www.theregister.com/security/2026/08/10/north-korean-spies-are-running-local-llms-to-cause-ai-mischief/5285632"
        description = "Detects AI-related packages and tools collected by Kimsuky for local LLM and RAG tooling development"
    strings:
        $pkg1 = "LLaMaSharp" nocase
        $pkg2 = "Microsoft.Extensions.AI" nocase
        $pkg3 = "Azure.AI.OpenAI" nocase
        $tool1 = "Ollama" nocase
        $tool2 = "GPT4All" nocase
        $tool3 = "Msty" nocase
        $tool4 = "Cursor" nocase
        $model1 = "Whisper" nocase
    condition:
        3 of them
}

title: Kimsuky LNK to PowerShell Execution Chain
id: 7a3c1f2e-8b4d-4e6a-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects LNK file execution spawning PowerShell with encoded commands, consistent with Kimsuky phishing campaign
author: Adverse Trace
date: 2026/08/10
references:

    - https://www.theregister.com/security/2026/08/10/north-korean-spies-are-running-local-llms-to-cause-ai-mischief/5285632
logsource:
    category: process_creation
    product: windows
detection:
    selection_lnk_spawn:
        ParentImage|endswith:

            - '\explorer.exe'
        Image|endswith:

            - '\powershell.exe'
            - '\pwsh.exe'
    selection_encoded:
        CommandLine|contains:

            - '-EncodedCommand'
            - '-e '
            - '-enc '
    selection_base64_pattern:
        CommandLine|re: '([A-Za-z0-9+/]{60,}={0,2})'
    condition: selection_lnk_spawn and selection_encoded
falsepositives:

    - Legitimate administrative scripts launched via shortcuts (rare)
level: high

title: Kimsuky System Information Collection via PowerShell
id: 8b4d2e3f-9c5a-4f7b-ad6e-2e3f4a5b6c7d
status: experimental
description: Detects PowerShell scripts collecting OS version, architecture, boot history, and running processes consistent with Kimsuky reconnaissance
author: Adverse Trace
date: 2026/08/10
references:

    - https://www.theregister.com/security/2026/08/10/north-korean-spies-are-running-local-llms-to-cause-ai-mischief/5285632
logsource:
    category: process_creation
    product: windows
detection:
    selection_powershell:
        Image|endswith:

            - '\powershell.exe'
            - '\pwsh.exe'
    selection_recon_commands:
        CommandLine|contains:

            - 'Get-CimInstance'
            - 'Get-WmiObject'
            - 'Get-Process'
            - 'systeminfo'
            - 'Get-ComputerInfo'
            - 'boot'
    filter_admin_tools:
        CommandLine|contains:

            - 'Get-Process | Select-Object'
    condition: selection_powershell and selection_recon_commands and not filter_admin_tools
falsepositives:

    - Legitimate system inventory scripts
    - IT administration tools
level: medium

Threat actor context

Kimsuky · G0094 · aka Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. …

7. Sources

• The Register — "North Korean spies are running local LLMs to cause AI mischief" — https://www.theregister.com/security/2026/08/10/north-korean-spies-are-running-local-llms-to-cause-ai-mischief/5285632 — 2026-08-10
• The Hacker News — "Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development" — https://thehackernews.com/2026/08/kimsuky-builds-offline-ai-stack-that.html — 2026-08-10

8. Adverse Trace position

This is a medium-severity threat-intelligence development relevant to EMEA financial services. Kimsuky (G0094) is a confirmed North Korean state-sponsored espionage actor with a demonstrated interest in finance and virtual asset themes. The operational significance is twofold: (1) the group's use of AI to generate polished phishing lures degrades the effectiveness of content-based phishing detection and user awareness training that relies on identifying poor grammar or formatting; and (2) the use of RAG over stolen documents accelerates the group's ability to identify and exploit valuable information from large data volumes, increasing the impact of any successful exfiltration. The attack chain itself — LNK → PowerShell → system reconnaissance → GitHub C2 — is not novel for Kimsuky, but the AI integration represents a capability uplift that defenders must account for. All technical detail in this advisory is single-sourced from Genians' research as reported by The Register and The Hacker News; no atomic IOCs have been published. We will monitor for Genians' full report and any IOC release, and will update clients if corroborating data emerges from additional sources. Clients should prioritise behaviour-based detection over content-based assessment and ensure EDR rules cover the LNK-to-PowerShell execution chain and anomalous GitHub repository access from non-developer endpoints.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.