Cybersecurity Company Genians Reveals Major Upgrade by North Korean Hacker Group Kimsuky in Generative AI Applications
Genians Reveals Kimsuky Builds Local LLM Attack System
Cybersecurity company Genians has disclosed that the North Korean hacker group Kimsuky, under the Reconnaissance General Bureau, has achieved a significant upgrade in generative AI applications.
The organization not only uses AI to create phishing bait but has also built a locally operated large language model environment and a retrieval-augmented generation system. Specific tools include local LLM management tools such as Ollama, GPT4All, Msty, and the AI code editor Cursor, with the goal of automating intelligence extraction and attack processes.
This disclosure strengthens the narrative supporting national cybersecurity threats, with funding shifting towards cybersecurity vendors capable of behavior detection and EDR capabilities, while traditional signature-based and manual analysis defense systems are under pressure, increasing the risk of local open-source AI tools being misused for attacks.
Source: Public Information
ABAB AI Insight
Kimsuky has long been identified as a threat actor associated with the North Korean Reconnaissance General Bureau, known for spear-phishing and supply chain attacks targeting diplomatic, defense, and cryptocurrency sectors. In recent years, multiple security firms have tracked its infrastructure evolution and toolchain updates.
Its capital and resource pathways are shifting towards localized AI capabilities: by deploying offline LLM management tools like Ollama, GPT4All, Msty, and the Cursor editor, it is building a RAG system that does not rely on external APIs, motivated by the desire to evade cloud service monitoring and sanctions, achieving an automated closed loop for intelligence processing and attack scripts.
Similar cases can be seen in early APT organizations transitioning from manual phishing to automated toolkits, as well as ransomware groups adopting AI-generated variant codes. Currently, state-level hackers are in a transition phase from human-driven to AI-enhanced attacks, with local open-source models becoming a new leverage.
This essentially represents a technological substitution: local LLMs and RAG shift intelligence extraction and attack orchestration from human reliance to machine automation, as open-source tools lower the barrier to acquiring advanced AI capabilities, enabling resource-constrained actors to achieve scalable, low-exposure attack processes.
ABAB News · Cognitive Laws
Open-source tools are a double-edged sword; equal capabilities also mean equal threats.
Localization is the ultimate path to evade monitoring.
The cost of automated attacks decreases faster than the upgrades in defenses.