Do Son 
AI-Enabled Attack Flow | Image: Genians Security Center
At a glance
- Actor: Kimsuky (suspected North Korea threat actor)
- Activity type: Spear phishing and AI experimentation
- Targets: Foreign diplomatic missions, military, security, and virtual asset sectors
- Scale: Undisclosed number of targeted victims
- Law-enforcement status: Allegedly state-sponsored; uncharged in this report
- Source: Genians Security Center
TL;DR
Genians Security Center uncovered Kimsuky AI operations involving local language models. The suspected threat actor allegedly uses these tools to build decoy documents. Attackers aim to automate social engineering campaigns. This activity highlights a major shift toward AI-assisted hacking.
What happened
Threat actors are changing their phishing methods. In a campaign dubbed Operation GitPower, attackers abused Git repositories. They used these platforms to distribute malicious payloads. The attackers sent ZIP archives containing dangerous LNK shortcut files. When victims click these files, hidden PowerShell scripts run in the background.
The command lines in the LNK properties contain very long strings. These strings conceal the actual PowerShell scripts. The attackers used custom decoders instead of standard functions. They downloaded harmless PDF files as decoys. At the same time, they installed AsyncRAT malware. The malware used RC4 encryption and hid as image files like “apple.png” or “fox.png”.
More importantly, the group built local LLM environments. They used tools like Ollama, GPT4All, and Msty. By keeping these models local, the attackers stopped their data from leaking to public AI services. They generated highly polished decoy documents about virtual assets. The report confirms this direct evidence. “AI can generate highly polished documents on a wide range of topics within a short period of time, making it a highly efficient tool for threat actors,” the report writes.
Who is behind it
Researchers assess that the Kimsuky group is responsible. This North Korea threat actor allegedly operates under the Reconnaissance General Bureau. Investigators found multiple linguistic clues linking the activity to North Korea.
For instance, logs showed the use of a Chinese-language WPS Office environment. Attackers used a system named “Arirang”. Attackers typed Korean sentences using standard South Korean keyboard layouts. “Both North and South Korea use national keyboard standards based on the Dubeolsik layout.” However, they used specific North Korean vocabulary like “싸이트”, “리력”, and “로출되였는지”.
Furthermore, attackers experimented with AI coding assistants. They allegedly used Cursor AI to edit scripts. The threat actor translated technical questions about Microsoft Defender from Korean to English. They pasted these translations into ChatGPT.
Impact or scale
The Kimsuky AI operations primarily target professionals in policy, academia, and diplomacy. The exact financial damage or victim count remains unconfirmed. However, the scale of automation poses a serious risk.
The group collected extensive libraries for AI agent development. They tested retrieval-augmented generation. “LocalDocs implements retrieval-augmented generation (RAG).” This feature allows the AI to answer questions based on stolen internal documents.
The threat actor stored database files like “localdocs_v3.db” in their network. This direct evidence shows they connected stolen documents to an AI system. They also used tools that integrate with cloud services like Claude and Gemini. These actions expand their ability to analyze massive amounts of compromised data.
They also gathered speech-to-text tools like Whisper. This software allows them to process stolen audio recordings quickly. The attackers downloaded numerous Korean-language learning materials on machine learning.
Currently, the group appears to be in a research phase. “At the time of observation, the threat actor was not at the stage of building AI itself, but rather at the stage of researching and acquiring the knowledge needed to integrate existing AI into its attack activities,” reads the report.
What comes next or how readers can stay protected
The integration of AI into cyberattacks will likely increase. Attackers can now create realistic phishing emails faster than before. Therefore, security teams must adapt their defenses.
Organizations should strengthen behavior-based endpoint detection. Defenders must hunt for abnormally long execution arguments in LNK files. They should also monitor for hidden PowerShell execution. Security teams must watch for unusual access to GitHub APIs.
Users must remain cautious when opening unexpected ZIP archives. Always verify the sender of official documents. Do not trust sudden honorarium requests or investment files. By staying alert, organizations can defend against these emerging AI-driven threats.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
