AI Signal 425
North Korean spies are running local LLMs to cause AI mischief
↗
North Korean cyber-espionage group Kimsuky is running locally hosted large language models and related AI tools to automate and enhance phishing, malware creation, and data harvesting.
Embedding AI in the attack chain lets the actors generate more convincing phishing content, automate code edits, and quickly sift stolen documents, raising the bar for detection. Defenders must now look for the presence of local LLM runtimes, AI libraries, and AI-driven workflows in otherwise benign environments, which adds new monitoring and policy requirements.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Kimsuky deployed local LLM stacks with Ollama, GPT4All and Msty to keep model interactions off the public cloud.
The group leveraged AI for phishing lures, code editing (Cursor), speech-to-text (Whisper) and retrieval-augmented generation to extract value from stolen files.
A collection of AI libraries and packages (e.g., LLaMaSharp, Microsoft.Extensions.AI, OpenAI SDKs) was assembled to build a custom AI-enabled attack toolkit.
THE CLUSTER