Kimsuky Uses Local LLMs, AI

Cybersecuritynews •Tushar Subhra Dutta • August 10, 2026

Kimsuky has been observed blending polished AI-made documents with familiar phishing tactics to push AsyncRAT, a remote-access trojan. The campaign shows how old delivery methods can gain new credibility when the bait looks professionally written and carefully formatted. The activity, tracked as Operation GitPower, begins with ZIP archives carrying Windows shortcut files that appear to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kimsuky Expands AI Capabilities for Cyberattacks The North Korean hacking group Kimsuky has developed local AI tools to enhance its cyberattack capabilities, as reported by Genians Security Center on August 10, 2026. The group is utilizing large language models (LLMs) such as Ollama and GPT4All, alongside retrieval-augmented generation (RAG) technology, to automate phishing campaigns and analyze stolen data without sending sensitive information to external services. Recent findings indicate that Kimsuky is creating sophisticated phishing lures that mimic legitimate financial documents, making them harder to detect. This marks a shift from previous tactics that primarily relied on reusing stolen documents. The group has been targeting sectors related to finance and cryptocurrency, utilizing AI-generated materials to enhance the effectiveness of its attacks. The U.S. Treasury had previously sanctioned Kimsuky in 2023 for its cyber-espionage activities supporting North Korea's strategic goals. 26 sources 78

Extracted Entities

Kimsuky Uses Local LLMs, AI

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)