Researchers found Kimsuky running language models on its own infrastructure, keeping its prompts away from the commercial services that could see what it is building.

 

What happened

Kimsuky, a cyber espionage group operating under North Korea's Reconnaissance General Bureau, has been setting up and running local large language model environments and gathering components to fold artificial intelligence into its attack operations, The Register reported. Researchers who spent months tracking the group observed it deploying Ollama, GPT4All, and Msty on infrastructure it controls, experimenting with the coding assistant Cursor, and testing retrieval-augmented generation, a method that lets a model answer questions by searching a private document collection rather than relying only on what it was trained on. Running the models locally keeps prompts and conversations off commercial AI platforms, where the activity could be spotted and shut down. The group has spent years targeting government agencies, think tanks, academia, and security research organizations. Investigators found no evidence that it has begun training models of its own.

 

Going deeper

The delivery method has stayed conventional while the lures have improved. Recent phishing emails carry ZIP archives containing malicious LNK files, the Windows shortcut format, dressed up as materials for international events, research reports, or meeting requests. Opening the shortcut runs an embedded PowerShell loader that collects operating system version and architecture, system configuration, installation and boot history, and a list of running processes, giving the attackers a picture of the machine before they decide what to do next. Some decoy documents were built with AI assistance around virtual asset and finance themes, and researchers described them as using natural language and a polished structure closely resembling real business materials. Base64 encoding, string splitting, and custom decoding routines hide what the files are doing from anything scanning them. Command-and-control traffic, meaning the channel an attacker uses to send instructions to infected machines, runs through public GitHub repositories the group operates.

 

What was said

The findings "provide concrete evidence that the Kimsuky-affiliated threat actor is moving beyond one-off experimentation with AI," researchers wrote in a report published August 10, 2026 and covered by The Register, describing continuous preparation to fold the technology into malware development, data analysis, and attack techniques. On the choice to run models in-house, they noted that keeping conversation data off external AI services "reduces the risk of external exposure," which makes the approach attractive to a state-sponsored operation.

 

In the know

What the group collected says more than what it has deployed so far. Alongside the local model environments, investigators found libraries including LLaMaSharp and Microsoft.Extensions.AI, packages for calling commercial AI services, logs referencing speech-to-text models, and evidence of retrieval-augmented generation being tested for document question answering. Assembled, those components span local execution, document retrieval, automated agents, and external service integration, a combination researchers read as deliberate tool building rather than curiosity. The retrieval capability deserves attention from anyone thinking about exfiltration, since running it against stolen files lets an attacker sort through terabytes of documents and surface the valuable material in hours rather than weeks. Speech-to-text extends that to recorded calls and dictated notes.

 

The big picture

North Korean operations have hit healthcare before, and federal agencies have said so repeatedly. The NSA, FBI, CISA, and HHS, working with counterparts abroad, issued a joint advisory on DPRK-sponsored ransomware against healthcare and public health organizations, following an earlier warning about attacks that encrypted electronic health record, diagnostic, imaging, and intranet servers. Separately, The Register reported in February on suspected North Korean intruders breaking into US healthcare and education organizations. What changes with AI-assisted lures is the training advice that no longer works. Guidance built around spotting awkward translation, broken formatting, and spelling mistakes assumes an attacker who cannot write well in the target language, and that assumption has expired.

 

FAQs

Why would attackers run models locally instead of using ChatGPT or similar services?

Commercial providers log activity, enforce usage policies, and have shut down accounts tied to state-sponsored operations. A model running on the attacker's own hardware produces no external record, which removes both the enforcement risk and the intelligence that providers otherwise share with defenders.

 

What makes LNK files a favored delivery method?

Windows shortcut files can carry embedded commands while displaying whatever icon the attacker chooses, so a file that looks like a document runs a script instead. Email gateways often treat them less suspiciously than executables, and the file extension is hidden by default in Windows Explorer.

 

Why use GitHub for command-and-control traffic?

Connections to a widely used developer platform look ordinary on most networks and rarely get blocked, unlike traffic to an unfamiliar server. Repositories also give attackers version control and storage for payloads and configuration, which is convenient for the same reasons it appeals to legitimate developers.

 

What behavioral signals indicate this kind of intrusion?

A shortcut file spawning PowerShell, PowerShell reaching out to fetch remote content, new persistence entries in registry run keys or startup folders, and outbound connections to code repositories or cloud services with no business reason. Individually, these are unremarkable, and in sequence, they warrant investigation.