North Korean threat actors are increasingly choosing an approach in which AI does not come from public tools, but runs on their own infrastructure. Genians reports that Kimsuky (a spying group under the Reconnaissance General Bureau) has set up an offline AI-stack: including local document search capabilities, speech-to-text, and components to integrate AI more effectively into the attack chain. That shifts the focus from “convincing lure text” to “behavior on the system”.
In this article, you’ll read what researchers say they found, which components fit into a phishing and malware workflow, and how defenders can correlate signals more intelligently.
What does Kimsuky’s offline AI-stack involve?
The core of the report is that Kimsuky runs AI functions locally on its own servers, without relying on public chatbots. According to Genians, they combined a document-search layer with files that the attacker already has access to. In addition, they collected software components they could use to integrate existing AI tools and building blocks into their operations.
An important detail: according to Genians, this is not about training their own AI model. The actor appears to be in a research and knowledge phase, assembling, configuring, and testing existing tools. That may already be enough to prepare attacks faster while making them less “recognizable”.
Which local AI tools were found?
Researchers identified multiple options for using language models offline. Among them, Genians mentions:
- Ollama for running a local model environment
- GPT4All configured with a specific database for retrieval-augmented generation (RAG)
- Msty as part of offline language processing
Genians reports that the tools weren’t only downloaded. For example, during initial startup, keys would have been generated by Ollama, and GPT4All would contain a local database localdocs_v3.db associated with the RAG function. RAG (retrieval-augmented generation) allows a language model to generate answers based on a private collection of documents, instead of relying solely on what the model “knows” on its own.
According to the researchers, that database is mainly evidence that the attacker wanted to link documents to an AI system. However, it does not automatically confirm that those documents were actually stolen.
Why is RAG relevant for phishing?
RAG can make phishing and social-engineering text more personal and context-aware. If an attacker can search their own material and then use it as the basis for text generation, the attack becomes less “generic” and more tailored to the topic the recipient is likely to expect.
For defenders, this point is especially challenging: traditional indicators often tied to awkward language or visible mistakes can partially disappear once AI processes context locally. That’s why Genians emphasizes a shift in what to look at: not only how convincing the lure text looks, but also what happens behind the scenes on the machine.
Which attack signals should defenders correlate?
Genians advises not to place too much value on any single aspect of the lure. Instead, defenders should connect multiple observations, including:
- LNK execution
- PowerShell activity
- hidden scheduled tasks
- GitHub traffic within the chain
- later payload activity
This recommendation aligns with the idea that the attack chain contains more “machine behavior” than “text quality”. Once AI helps produce the bait faster, the difference between attacker and defender becomes most visible in logging, execution, and network patterns.
More than off-the-shelf apps: building blocks for AI in C#/.NET
The offline AI-stack seems to be more than just tools for language models. Genians also found developer libraries that can be used to embed AI functionality into custom software. These include:
- LLaMaSharp
- Semantic Kernel (from Microsoft)
- Microsoft.Agents.AI
Components like these fit the idea that Kimsuky’s AI isn’t only “used”, but also attempts to be built into a C#/.NET workflow. That makes it possible to automate text processing, analysis, or other AI-driven tasks within the same attack chain.
In addition, the researchers found a guide and speech-to-text files in the style of Whisper, including hints for extracting text from audio. There were also traces of an AI code editor (Cursor).
According to Genians, nothing in this is exceptional on its own. The “new” part is mainly that a state-linked espionage group purposefully combines these elements to embed AI more deeply into its own attack process.
Operation GitPower: GitHub as a command channel
Genians links the observations to a campaign it calls Operation GitPower. In this approach, GitHub repositories are misused as command channels within an infection chain.
The chain described by Genians runs from LNK to PowerShell, using GitHub traffic as the link toward the final payload. At the same time, encrypted AsyncRAT payloads were distributed that present themselves as image files.
That suggests the offline AI-stack mainly adds an extra layer to preparing or executing parts of that broader workflow: faster redaction work, better context handling, or automation around analysis or development tasks.
What don’t we know (yet)?
A key nuance in the report is that, so far, the offline AI-stack has not been convincingly tied back to actual execution against a victim. Genians states that the locally found AI components and the associated database have not yet been demonstrated as “live used” in a real victim attack in the reporting.
No public number of victims has been provided for GitPower either. Furthermore, Reuters (as cited in the source report) reports that new findings could not be independently verified. That means: take the direction and indicators seriously, but treat the exact practical impact as still developing.
Why this matters for organizations
When AI runs locally, attacks are not automatically less technical—but the way you can spot them changes. Usage patterns from public AI services disappear, while host-based traces (such as scripting, scheduled tasks, and later payload behavior) become more important.
This also fits a broader theme in security: attackers invest in tooling that speeds up and improves how well they adapt their process. That’s why it’s worth focusing your detections on the “chain” rather than only the quality of the text.
If you want more depth on signals in phishing approaches and how to recognize AI-assisted deception, you can also read how attackers misuse passwords and tokens via webmail attacks: CSS-attacks on webmail: passwords and tokens.
A concrete defensive approach: from lure to workflow
Based on Genians’ findings, you can sharpen your defense strategy in the following ways.
1) Correlation over isolated alerts
Create detections that combine multiple signals: LNK execution, PowerShell actions, scheduled tasks, and network patterns toward command channels. A single standalone alert is easy to mislead; a chain pattern reveals more about intent.
2) Watch for “quiet” behavior
Where lure texts were previously often assessed for imperfections, that becomes less reliable. Focus instead on what happens on endpoints after a user opens the document or executes a file.
3) Investigate in context
If you have suspicions, link endpoint observations to network metadata. In a GitPower-like chain, it’s often not only about what runs locally, but also about traffic later in the chain that helps fetch or drive payloads.
Conclusion
According to Genians, Kimsuky uses an offline AI-stack to prepare phishing faster and bring AI functions deeper into its own attack path. The report describes local language-model environments (such as Ollama and GPT4All), a RAG database to generate answers based on private documents, and additional building blocks for development in C#/.NET. The most valuable takeaway for defenders is the shift from “what does the lure look like?” to “what happens in the chain on the machine?”.
With correlations around LNK, PowerShell, hidden scheduled tasks, GitHub traffic, and payload activity, you can better detect that offline AI support—even as the lure text becomes more convincing.
Source: https://thehackernews.com/2026/08/kimsuky-builds-offline-ai-stack-that.html
