Incident report · TESSOC: Cyber / Espionage

Capability development - state cyber-espionage

Kimsuky: North Korea takes its AI offline

A North Korean state hacking group has installed artificial intelligence software on its own servers, so that it can run the technology entirely offline. No provider to log what it asks, no terms of service to breach, nobody to switch it off.

That matters more than what it has done with it so far. The evidence is of a group learning to use these tools, not one already using them against victims - and the reporting has not been independently verified. The finding is about where controls can be applied, not about a new weapon in the field.

Scorpius Security & Intelligence Solutions · July 2026

↓ Download one-page brief (PDF)

Who

Actor: Kimsuky, also tracked as APT43, Velvet Chollima and Thallium - a cyber-espionage group reported to operate under North Korea's Reconnaissance General Bureau, and sanctioned by the US Treasury in 2023 as a state-controlled espionage unit. Disclosed by: Genians, a South Korean security company, after months tracking the group's infrastructure. Casualties: not applicable; no victim of the AI capability has been identified.

What

Genians found that Kimsuky had installed, configured and run software for operating large language models on its own machines. A large language model is the technology behind chatbots; normally it runs on a provider's servers, which means the provider sees the requests. Run locally, it does not. The group also tested a method for pointing such a model at its own collection of documents, and gathered coding libraries, a speech-to-text tool and an AI coding assistant.

Where

On infrastructure Genians attributes to the group. Targeting is directed at South Korean organisations - reported to include diplomatic missions and military, security, policy, academic, cryptocurrency and financial-sector targets.

When

Published Monday 10 August 2026, following months of infrastructure tracking. The activity builds on earlier Kimsuky campaigns.

Why

Running the technology in-house removes the provider from the equation. There is no account to suspend, no usage log held by a third party, no refusal to answer a request, and no limit on how much can be processed.

How

Three separate programs for running models locally were found installed. Genians established they had been run and not merely downloaded - one generates a unique key file the first time it starts, and that file was present; another held a configured database belonging to its document-search feature.

What happened

The starting point - a phishing campaign

Genians has been tracking a Kimsuky campaign it calls Operation GitPower. It begins with a shortcut file sent to a target. Opening it runs a hidden command that installs remote-access software - a program that gives the attacker control of the machine - concealed inside what looks like an image file.

Code repositories used as the control channel

Rather than connecting to a suspicious server, the software takes its instructions from public code repositories on GitHub. Traffic to a site used by millions of developers looks unremarkable on a corporate network, and the attacker can change the instructions at any time.

The lures stop looking foreign

Genians found decoy documents - on cryptocurrency, financial investment and game development - showing signs of AI generation. They are professionally laid out and written in natural language. The traditional tells of a foreign phishing attempt, the stilted translation and the spelling errors, are exactly what this removes.

Three local AI environments, installed and run

On the group's own infrastructure, investigators found three separate programs for running language models offline. Forensic traces show they were executed rather than merely obtained. One carried a configured database for its feature that lets a model answer questions from a private collection of documents.

And the limits of what was found

Genians assesses the group is accumulating capability rather than deploying it. It found no evidence that Kimsuky had trained its own models. The offline stack has not been shown operating against any victim in the reporting so far, and Reuters reported the findings could not be independently verified.

Impact

Immediate

None demonstrated. No victim of the AI capability has been identified and no incident has been attributed to it. This is a finding about preparation.

Detection

Better lures defeat the advice most organisations give their staff. "Look for poor English and odd formatting" has been the backbone of phishing awareness training for twenty years, and it is the specific thing this removes.

Policy

The significant effect. Much of the effort to prevent AI misuse assumes it can be policed where the technology is provided - by monitoring, refusing and suspending accounts. A capable actor running the same technology on its own hardware is outside all of that, and the software required is free and publicly available.

Context

North Korean cyber operations are a sanctions-evasion revenue stream as well as an intelligence one. Reporting attributes over two billion dollars in digital asset theft to DPRK-linked actors in 2025, including a single exchange theft of about 1.5 billion. Anything that raises the tempo of that activity has a financial as well as a security consequence.

What the words mean, and where this sits

The technology

Running a model locally

A large language model is the software behind chatbots. Used through a commercial service, every request passes through the provider, which can log it, refuse it or cut the account off. The same class of model can be downloaded and run on ordinary hardware with no internet connection - weaker than the best commercial systems, but nobody is watching.

The technique

Pointing a model at your own documents

A model can be connected to a private library of files so that it answers using those files rather than general knowledge. Genians found this feature configured. It is worth being precise: this shows an intent to connect held documents to an AI system. It does not establish that those documents were stolen.

The precedent

Commercial AI already abused, and detected

Kimsuky was previously reported using a commercial chatbot service to help generate phishing material. That was visible to the provider. Moving the same work in-house is the logical answer to being seen.

The pattern

Trusted platforms as infrastructure

Using GitHub to carry attacker instructions is part of a wider trend of hiding inside services an organisation cannot simply block. Another security firm documented the same GitHub technique against South Korean targets earlier in the year.

Two things are true at once and both matter. The capability found is early - installed, configured, tested, not yet demonstrated in an attack. And the barrier it steps around is one a great deal of policy effort currently rests on. The first should temper the alarm; the second should not be reassuring.

Assessment

The headline overstates what was found, and the finding is still important

Descriptions of an operational AI attack platform go beyond the evidence. Genians assesses the group is accumulating capability, found no evidence of self-trained models, and the offline stack has not been observed running against a victim. Reuters could not independently verify the findings. What is established is that a state espionage group has stood up local AI infrastructure and tested it. That is a real and significant development described accurately, and it does not need inflating.

Provider-side controls cannot reach an actor who does not use a provider

The main lever against AI misuse today is applied where the technology is served: monitoring, refusal, rate limits, account suspension. All of it depends on the actor coming to a provider. The software to avoid that is free, legal and widely used for entirely legitimate reasons. It is almost certain that other state and criminal actors reach the same conclusion, if they have not already.

The most immediate practical effect is on phishing awareness training

Generations of staff have been taught to spot bad translation, clumsy formatting and spelling errors. Genians describes decoy documents that read like genuine business correspondence. The advice most organisations have given is now the advice most likely to fail, and it will fail quietly, because a convincing email produces no alarm.

Detection has to move to behaviour, and the vendor says so plainly

Genians recommends correlating what happens after a file is opened - a shortcut executing, a hidden command running, a task being scheduled to persist, unexpected connections outward - rather than judging a message by how it reads. That is a shift from recognising bad content to recognising abnormal activity, and it does not depend on the lure being poorly written.

Expect this to become ordinary rather than remarkable

The tools are free, the hardware is unremarkable and the motive is obvious. It is highly likely that locally hosted AI becomes a routine part of state and criminal cyber operations, and likely that the visible effect on defenders is a steady improvement in the quality of social engineering rather than any single dramatic capability.

The comparison worth making

Set this beside NightLedger, where the interesting part was not the malware but the way a victim was turned into infrastructure. Here too the technical novelty is modest and the structural point is what counts: an adversary removing itself from a place where it could be observed. In both cases the defensive answer is the same - watch behaviour on your own network, because the parts you were relying on someone else to see are moving out of view.

What should carry

Retire "look for bad English" as phishing guidance. It is the single most common piece of advice in awareness training and it is the thing this development removes. Replace it with guidance about unexpected requests, unusual attachments and verifying through a separate channel.
Teach people to check the ask, not the prose. A convincing, well-written message requesting something out of the ordinary - a payment, a credential, a file - deserves the same suspicion as a badly written one. The question is whether the request makes sense, not whether it reads well.
Be cautious with shortcut files and unexpected archives. This campaign starts with a shortcut file that runs a hidden command when opened. A file that claims to be a document but behaves like a program is worth stopping for, and staff should have somewhere to send it.
Ask who watches your outbound connections. Traffic to a well-known code-hosting site looks legitimate. Someone should be able to say whether a machine on your network is contacting one, and whether that is normal for that machine.
Do not rely on AI providers to police this on your behalf. Provider-side safeguards are real and useful, and a determined actor is now demonstrably outside them. Any security posture built on the assumption that misuse is caught upstream needs revisiting.
Keep multi-factor authentication on, and treat credential requests as the crown jewels. Whatever generates the lure, the objective is usually the same: an account. Good writing does not defeat a second factor.
Push your security supplier on behavioural detection. Ask specifically what they would see after a malicious shortcut is opened, not what they would block beforehand. That is the question this research puts to every defender.

Sources

Compiled from open-source reporting for professional security discussion. This is a security vendor's finding. Attribution to Kimsuky rests on Genians' analysis of infrastructure overlaps, campaign links and North Korean-language artefacts, and Reuters reported that the findings could not be independently verified. Genians itself assesses the group to be accumulating capability rather than deploying it, found no evidence that it had trained its own models, and the locally hosted software has not been shown operating against any victim in the reporting to date. The presence of a configured document-search database indicates an intent to connect held files to an AI system; it does not establish that those files were stolen. Technical indicators are not reproduced here. Details may be revised. This is a protective-security lessons-learned assessment, not an operational account.