Kimsuky Runs Offline LLMs to Sharpen Phishing, Build Malware

Forensic Summary

North Korean APT group Kimsuky has assembled a private, offline AI stack — including Ollama, GPT4All, and RAG tooling — to enhance spear-phishing lure quality and automate malware development in C#/.NET. South Korean firm Genians found configured instances of these tools on Kimsuky-linked infrastructure, alongside developer libraries such as LLaMaSharp and Microsoft Semantic Kernel, indicating deliberate integration of AI into the group's attack pipeline. The shift erodes traditional phishing detection signals like poor grammar and formatting, forcing defenders to pivot toward behavioural indicators on the endpoint.

---

Read the full technical deep-dive on Grid the Grey: https://gridthegrey.com/posts/kimsuky-runs-offline-llms-to-sharpen-phishing-build-malware/