Critical APT Warning: No Longer Relying Solely on Cloud LLMs — Kimsuky Deploys Offline Local LLMs for Full-Chain AI-Enabled Espionage and Data Theft

Article Summary:
The North Korean APT group Kimsuky has deployed offline local large language models (Ollama, GPT4All) combined with RAG, Cursor, and Whisper to achieve full-chain AI-enabled attacks—from phishing lure generation and malware coding to automated analysis of stolen documents. This model leaves no cloud logs, does not leak data externally, and is extremely difficult to attribute. Defence must shift towards behaviour monitoring, email gateway filtering, and sensitive data control, with particular emphasis on detecting LNK files and GitHub payload download behaviour.

Categories: Threat Intelligence, Malware, Red Team, Security Operations, Data Security

Executive Summary #

The use of AI in cyber attacks has largely involved threat actors calling online cloud-based large language models such as ChatGPT or Claude to generate phishing emails and forge documents. However, the latest disclosure by the security vendor Genians regarding Operation GitPower reveals that Kimsuky (also tracked as APT43), an APT group subordinate to North Korea’s Reconnaissance General Bureau, has completed the construction of an entire offline AI attack environment. This includes the deployment of local large language models such as Ollama and GPT4All, a Retrieval-Augmented Generation (RAG) retrieval enhancement system, the Cursor AI code assistant, and the Whisper speech-to-text tool.

All AI computation is performed locally on the attackers’ own servers. Data does not flow to third-party cloud services, and no cloud conversation logs are left behind. From generating highly convincing spear-phishing lures and writing malicious code to automatically parsing stolen classified documents after intrusion, the group has achieved full-chain AI efficiency enhancement for espionage work. The targets are diplomatic, defence-industrial, scientific research, and virtual asset financial sectors.

1. The APT’s Offline AI Weapon Stack: A Full Suite of Open-Source Tools Running Locally #

Security personnel have captured extensive traces of tool operation within Kimsuky’s attack infrastructure. The entire environment is assembled from publicly available open-source AI software. It does not require self-developed large models, and the barrier to deployment is not high:

1.1 Local Large Language Model Runtime Layer: Ollama / GPT4All / Msty #

Open-source large models are deployed locally on compromised servers controlled by the attackers. There is no need to access external AI services. All inputs and outputs remain within the attackers’ internal network.

1.2 RAG Retrieval-Augmented Knowledge Base (LocalDocs) #

Contracts, reports, and meeting minutes stolen after intrusion are imported in bulk into a local knowledge base. The AI automatically summarises vast quantities of stolen documents and extracts key intelligence, eliminating the need for manual review by the attackers.

Significant risk: The victim’s classified materials are not uploaded to external AI platforms. External vendors obtain no access logs whatsoever, making attribution and forensic investigation extremely difficult.

1.3 AI Code Development Tool: Cursor #

Extensive log traces show that the attackers make frequent use of Cursor to assist in writing and iterating PowerShell and RAT remote-control malicious payloads, reviewing generated malicious output, and accelerating Trojan development.

1.4 Speech Processing: Whisper (faster-whisper) #

After stealing recordings and meeting audio, the tool automatically transcribes them into text in bulk, rapidly mining confidential conversations contained in the audio.

1.5 AI Agent Development Frameworks: LLamaSharp, Semantic Kernel #

These are used to connect the various AI components and attempt to automate portions of the attack tasks.

Genians assessment: The group is currently still in the stage of technical validation and iteration. It has not trained a dedicated large model from scratch. It mainly reuses mature open-source AI tools available on the market to build its own attack workflow.

2. Attack Chain Upgrade: AI Permeates the Complete Chain from Phishing Delivery to Intrusion and Intelligence Processing #

2.1 Spear-Phishing Lure Stage: AI Generates Convincing Business Documents #

The attackers no longer simply copy or reuse old documents. For targets in the cryptocurrency and financial sectors, they use local large models to generate highly realistic reports, cooperation agreements, and investment analysis documents.

The text flows naturally, the formatting is complete, and the documents closely resemble genuine business materials, reducing victim vigilance. Lures are generally packaged into ZIP archives containing LNK malicious shortcuts disguised with PDF icons. When the user double-clicks what appears to be a document, a PowerShell payload executes silently in the background, pulling the AsyncRAT remote-control backdoor from a GitHub repository.

2.2 Intrusion and Residency: GitHub as a C2 Command Channel #

The signature tactic of Operation GitPower: encrypted malicious payloads are disguised as images and stored in public GitHub repositories. Compromised hosts periodically pull updated payloads. The normal business traffic of GitHub effectively masks the attack behaviour.

2.3 Post-Exfiltration: Local RAG Automatically Digests Vast Quantities of Classified Materials #

After obtaining large volumes of internal documents, recordings, and chat records, these are fed directly into the local RAG knowledge base:

• Automatic filtering of high-value intelligence, extracting key names, projects, funding, and negotiation information;
• Bulk transcription of audio recordings into text;
• Classification and organisation of vast numbers of files, greatly reducing the manual analysis workload for the attackers.

Key risk: All of this is completed entirely offline. There are no cloud logs to trace.

2.4 Additional Reconnaissance Behaviour #

The attack also actively probes for leaked victim information, including virtual asset wallets, Gmail accounts, and website registration histories, in order to further expand the scope of subsequent social engineering attacks.

3. Why “Local Offline AI Attacks” Are More Troublesome Than Cloud AI #

3.1 No Cloud Audit Traces #

When attackers use online large models such as ChatGPT, prompt conversation records are left on the service provider’s side and can serve as threat leads. With a local Ollama deployment, the entire computation takes place on the attackers’ own servers, and external parties cannot see any interaction traces whatsoever.

3.2 Data Does Not Leak Externally #

With traditional cloud AI, uploaded classified materials enter the large model service provider’s system. With offline RAG, data circulates only within the attackers’ internal network. External parties cannot discover intelligence leakage through AI platforms.

3.3 Faster Attack Iteration #

With the assistance of AI coding tools such as Cursor, the efficiency of modifying and debugging malicious scripts and payloads is greatly improved, enabling the rapid generation of multiple anti-detection sample versions.

3.4 Continuously Improving Lure Quality #

Local large models can combine already-stolen victim business context to customise phishing documents that closely match the target’s business scenarios.

4. Practical Recommendations for Enterprise Detection and Defence #

The Genians Security Centre specifically notes that in the face of AI-generated lures, static detection based solely on document keywords is becoming increasingly ineffective. The focus of defence must shift to behaviour detection and threat hunting from an EDR behaviour perspective.

4.1 Security Team Implementation Points #

1. Endpoint threat hunting: priority behaviours to monitor

• Be alert to .lnk disguised document shortcuts inside incoming ZIP archives;
• Monitor abnormal outbound connection behaviour where PowerShell downloads scripts or payloads from GitHub raw addresses;
• Identify IOCs associated with the AsyncRAT remote-control family, and monitor scheduled task persistence behaviour.

2. Email gateway protection

• Strengthen spear-phishing email filtering for high-risk departments such as diplomatic, defence-industrial, scientific research, and blockchain finance;
• Be alert to attachments that are ZIP files containing LNK shortcut files with PDF or Word icons. These are high-frequency vectors in Operation GitPower.

3. Do not rely solely on document content detection for phishing

• AI-generated documents are highly realistic in grammar and formatting. Traditional keyword matching is prone to failure. Prioritise attachment type, file extension, file metadata, and file provenance chain.

4. Sensitive data control

• Add watermarks and minimise permissions for high-value classified documents. Once stolen, attackers can rapidly parse all information through local RAG.

4.2 Employee Security Guidance #

1. When receiving a ZIP archive from an unfamiliar email, prioritise inspecting the file extension after extraction. Do not double-click files that appear to be PDF or Word documents but actually have a .lnk extension.
2. For cooperation reports, investment analyses, and industry briefings from unknown sources, always verify the sender’s identity through a second channel such as telephone or official channels.

5. Security Implications #

AI-enabled attacks have evolved to a new stage. They are no longer used merely to write phishing emails. Attackers are beginning to build complete offline AI operational environments.

The barrier to entry for open-source large models continues to fall. APT groups can privatise an entire suite of AI capabilities, freeing themselves from dependence on external online services such as ChatGPT. Intelligence processing and malicious code development are completed within their own internal network loop.

This means that the previous attribution approach of “capturing cloud AI logs” will gradually become ineffective. Security defence needs to shift from “identifying whether document content is genuine” to monitoring file execution behaviour, abnormal outbound connections, and malicious persistence actions.

Closing Discussion #

Does your current EDR generate alerts for behaviour such as LNK files combined with GitHub payload downloads? How do you view the risk of local large models being abused by APT groups? Discussion is welcome in the comments.

Disclaimer:

The procedures and technical methods contained in this article are intended solely for legal and compliant security research and teaching scenarios, with the aim of enhancing network security protection capabilities. They possess clear technical research attributes.

Any unit or individual that uses the content of this article for illegal purposes such as attack or destruction without authorisation shall bear all legal liability, civil compensation, and joint liability independently; this site assumes no joint liability.