North Korean hacker group Kimsuky is using local AI systems to target cryptocurrency and financial firms with sophisticated cyberattacks, according to a report released Monday by Genians.
The South Korean cybersecurity firm found evidence that the group built and operated three local large language model (LLM) environments using Ollama, GPT4All, and Msty.
These tools allow offline operation and support retrieval-augmented generation, enabling hackers to make queries without sending data to external cloud services.
The group has also collected libraries and frameworks to embed language models into custom software, along with the AI coding assistant Cursor and speech-to-text tools.
Genians said this activity focused on integrating existing open-source AI models into malware development, data analysis, and attack automation.
