North Korean cyber operators tied to Kimsuky are running local large language model environments and gathering AI tooling for attack operations, according to The Register, citing a report from South Korean security firm Genians. Genians said it observed Kimsuky-affiliated activity involving Ollama, GPT4All, and Msty, along with experimentation using Cursor and retrieval-augmented generation for local document search. The significance of the local setup, in Genians’ view, is operational control: prompts and documents do not need to pass through external AI services, reducing the chance that sensitive attacker data is exposed to cloud providers or defenders monitoring those platforms. The Register describes Kimsuky as a North Korean cyber-espionage group operating under the Reconnaissance General Bureau. The group has long used phishing and decoy documents against government agencies, think tanks, academia, and security research organizations. Genians’ report, as summarized by The Register, argues that the activity points beyond isolated AI testing and toward preparation for practical use in malware development, data analysis, and attack refinement. The campaign mechanics remain familiar. Genians said recent phishing emails used ZIP archives containing malicious LNK shortcut files, often disguised as materials tied to international events, research reports, or meeting requests. If a recipient opens the archive and runs the LNK file, the shortcut launches an embedded PowerShell loader. Genians also reported that some lures connected to virtual assets and finance were created with AI. The documents were described as using more polished language and business-style formatting to increase trust and induce victims to run malicious files. That is a narrower claim than saying AI is automating the whole intrusion chain: based on the provided reporting, the documented use includes lure generation and local AI infrastructure, while Genians says the operators are preparing broader attack capabilities. The technical behavior described by The Register includes obfuscation methods such as Base64 encoding, string splitting, and custom decoding routines. Once run, the PowerShell script collects system details including operating system version and architecture, system configuration, PC type, installation and boot history, and running processes. Genians said the attackers use that information to evaluate the infected environment and support follow-on activity. The report also ties the activity to Git-based command-and-control infrastructure. Genians Security Center reportedly identified multiple public GitHub repositories operated by the threat actor, including repositories containing configuration files, PowerShell scripts, and payloads for later stages. The same Git-based infrastructure was also used, according to Genians, for malware development and testing, stolen-data management, and AI technology research. For defenders, the important point is not that AI makes the underlying tradecraft new. The chain still relies on phishing, archives, shortcut files, PowerShell, obfuscation, host reconnaissance, and command-and-control. The change Genians is flagging is that a known state-linked actor appears to be building local AI workflows around those existing methods, potentially improving lure quality and supporting internal analysis without sending attacker material to outside services. Who benefits: If Genians’ findings are accurate, Kimsuky benefits from local AI systems that can support lure creation and analysis while keeping operational data off external AI services. Local tooling may also give attackers more control over sensitive documents used during campaigns. Who's exposed: Organizations already named as Kimsuky targets remain exposed: government agencies, think tanks, academia, and security research organizations. The Register also reports lures related to virtual assets and finance, indicating those themes are being used in recent phishing activity.