Kimsuky Builds Offline AI Stack to Automate Phishing and Malware

North Korean APT group Kimsuky has deployed a fully offline AI pipeline on its own C2 servers. Genians researchers documented the stack, which includes local LLM runtimes, a RAG database, orchestration libraries, and speech-to-text tools — signaling a shift toward industrial-scale, cloud-free attack automation.

On August 10, 2026, researchers from South Korea's Genians published a dossier tracing months of activity on C2 infrastructure controlled by the North Korean APT group Kimsuky. The discovery is not another case of casual public chatbot use: operators installed, configured, and ran a fully offline AI stack — local models, document-retrieval databases, orchestration libraries, and speech-to-text tools. The shift rewrites detection rules: traceable cloud service noise disappears, along with the traditional low-quality indicators that often betrayed hand-crafted phishing.

Key Takeaways

Kimsuky installed and configured three local LLM runtimes — Ollama, GPT4All, Msty — leaving execution traces, not just downloads
Analysts found an active RAG database (localdocs_v3.db) for querying private documents, and .NET libraries covering the full arc "local execution → retrieval → automated agents → external AI integration"
Decoy document metadata show identical timestamps two weeks apart, indicating scripted, automated generation
Genians places the stack in a "research and knowledge acquisition" phase, not proprietary model training: no fine-tuning datasets were recovered

How the AI Stack Found on C2 Servers Works

The strongest evidence concerns Ollama, a framework for running LLM models locally. Genians researchers recovered SSH authentication key files generated automatically on the program's first run — creation that occurs only during execution, not from a mere download. GPT4All, the second identified tool, contained the file localdocs_v3.db, which the software creates exclusively when the user enables the LocalDocs function to index private documents and query the model with retrieval-augmented generation. Msty, a multi-model orchestration platform, showed installation traces with integration for Ollama, ChatGPT, Claude, Gemini, and MCP support.

The collected development components span a hidden directory named "Pictureszzznupkg." TechTimes, reproducing the Genians report, detailed .NET libraries covering the entire pipeline: LLaMaSharp for local model bindings in C#, Microsoft.SemanticKernel and Microsoft.Agents.AI for agent orchestration, Microsoft.Extensions.AI and OpenAI/Azure.AI.OpenAI for external service integration, LangChain for chaining, and CUDA 11 and 12 backends for GPU acceleration. The density and functional coherence of the components, as the researchers note, "suggests they were not gathered out of mere curiosity, but for the direct development of a purpose-built AI tool."

Speech-to-Text and Decoy Documents: Traces of Automation

The stack includes audio processing capabilities. OpenAI Whisper and faster-whisper were found, accompanied by a Korean-language guide titled "Let's extract text from audio files." The installation suggests intercepted or stolen audio documents can be converted into automatically analyzable text without passing through registered cloud services.

The clearest evidence of industrial automation, however, lies in the metadata of PDF decoy documents. TechTimes reported the forensic analysis: Author set to "python-docx," Creator to "WPS Office," with identical timestamps of 5:00:04 and 5:00:44 on files created two weeks apart — March 11, 2026 and March 24, 2026. A forty-second gap at a fourteen-day interval constitutes a classic scheduled-script pattern, not manual composition. The finding aligns with Genians' assessment: "this change goes beyond a shift in how decoy documents are created and demonstrates that AI can enable the automation and large-scale production of social engineering attacks."

"The fact that all three tools left installation traces is an important indicator that the threat actor did not merely test a single tool by chance, but broadly compared and evaluated multiple approaches to running AI models locally" — Genians, via TechTimes

The Operation GitPower Campaign and C2 Context

The AI stack was identified on infrastructure linked to Operation GitPower, a campaign named by Genians that abuses GitHub as a C2 channel with encrypted AsyncRAT payloads. Fortinet had already documented similar GitHub-C2 patterns in April 2026 against South Korean users, providing independent corroboration of the command-and-control methodology, if not the specific AI stack.

Also recovered from the servers was a textual operator request: "The more detailed the analysis, the better. Please do not do it haphazardly." The message, accompanied by references to datasets containing wallets, Gmail credentials, and site registration histories, is consistent with input preparation for an automated analysis system, though Genians does not confirm the request was actually submitted to an AI service.

Active traces of the Cursor editor, an AI-powered coding tool, complete the picture of an integrated development environment where AI assists malicious code production without exposing snippets to registered external platforms.

Why the Offline Shift Alters Detectability

The move from cloud tools to a local stack eliminates two traditional categories of defensive signal: connections to detectable public APIs at the network level, and quality artifacts that often betrayed hand-crafted or uncontrolled-model content. Translation errors, inconsistent formatting, poor spelling — all behavioral indicators useful to analysts — lose relevance when the model is local, the prompt is curated, and the output is fed into automated templates.

The transition is qualitative, not just quantitative. Genians explicitly positions the stack in a "research and knowledge acquisition" phase: no training datasets or fine-tuning outputs were found, so the actor is not training a proprietary model. But the systematic collection of components covering local execution, retrieval, agents, and external integration describes an architecture under construction, not an isolated experiment. The goal appears to be automation of the entire cycle: indexing stolen documents, generating tailored lures, analyzing audio intercepts, producing code — all on controlled servers, without telemetry to providers.

Data Chain of Custody and Dossier Limits

Several elements remain unverified in the available reporting. Genians does not confirm that documents indexed in the RAG database are of illicit origin: the report indicates only "in its possession," without proof of theft. It is not confirmed that decoy documents with automated metadata were distributed to real victims, nor that the stack was observed in active execution against a target during monitoring. The operator request to analyze datasets is not verified as actual input to an AI system. Reuters, cited in The Hacker News reporting, explicitly stated the new findings are not independently verifiable.

The number of Operation GitPower victims is undisclosed, and the specific LLM model used for decoy document generation is unidentified: researchers have only the metadata patterns, not the engine. The full timeline of AI stack development — start date, maturity level, any operational deployment — cannot be reconstructed from public material.

These limits do not diminish the finding's value, but they circumscribe its nature: it is a snapshot of infrastructure in preparation, not documentation of a completed attack. The distinction matters for defensive resource allocation: the signal is early, not retrospective.

What to Do Now

Align phishing detection on post-intrusion behavior and delivery-chain compromise indicators rather than linguistic quality alone: local AI generation makes text quality an unreliable signal
Monitor installation and execution of local LLM frameworks — Ollama, GPT4All, Msty, Whisper — on enterprise endpoints and servers, which should not be present in normal environments
Examine inbound document metadata: identical timestamps, Author "python-docx" or Creator "WPS Office" in repeated patterns are indicators of automated generation to evaluate in the context of the provenance chain
Review GitHub-as-C2 detection policies, a methodology documented by Fortinet in April 2026 and now integrated into the Operation GitPower campaign with encrypted payloads

Frequently Asked Questions

Is Kimsuky training its own AI model?

No. Genians explicitly ruled out this evidence: no training datasets or fine-tuning outputs were found. The stack is in a "research and knowledge acquisition" phase, running pre-trained models locally.

Have the automatically generated documents already been used in real attacks?

Not confirmed. PDF metadata indicate automated generation, but reporting does not document that these documents were actually distributed to victims. They may be in a testing phase.

Why is the offline stack more dangerous than public chatbots?

Because it eliminates telemetry to traceable cloud services and removes the quality artifacts that often allowed identification of unsupervised generated content. The attack becomes more homogeneous and less noisy.

Information verified against cited sources and current as of publication.

Sources

Sources and references