AI Weekly Malaysia

South Korean security firm Genians reports that North Korean threat group Kimsuky is running local LLMs via Ollama, GPT4All, and Msty, and experimenting with Cursor and RAG for local document search, keeping operations off cloud services to avoid detection. The group uses AI to craft polished phishing lures about virtual assets and finance, delivered via ZIP archives containing malicious LNK files that run PowerShell loaders, with GitHub repositories serving as command-and-control infrastructure.

Why: Threat actors are now using the same local LLM toolchain (Ollama, GPT4All, Cursor) that many developers and AI tinkerers run, meaning AI-generated phishing lures will be increasingly convincing and harder to spot. Builders should scrutinize unfamiliar GitHub repositories more carefully since Kimsuky uses public GitHub repos as C2 infrastructure, and treat unsolicited ZIP/LNK files—even those referencing research or events—as high-risk.

South Korean security firm Genians reports that North Korean hacking unit Kimsuky has set up an offline AI stack on its own infrastructure using Ollama, GPT4All, and Msty, with GPT4All's LocalDocs RAG database (localdocs_v3.db) configured to query a private document collection. The group has not trained a custom model but is assembling existing tools to automate malware development and improve phishing lures, which will increasingly lack the traditional tells of stilted translation and formatting errors.

Why: If you build or operate systems that rely on users spotting phishing by its clumsy language or formatting, that defense layer is eroding—AI-generated lures will read naturally. Shift detection toward correlating technical indicators like LNK execution, PowerShell activity, hidden scheduled tasks, and unusual GitHub traffic rather than judging emails by polish. For builders running offline LLM stacks (Ollama, GPT4All), note that these same tools are now documented in nation-state offensive operations.