North Korean hacking group Kimsuky has set up tools to run and manage AI models locally, according to South Korean cybersecurity company Genians. According to Foresight News, the group has also collected information on retrieval-augmented generation (RAG) technology, AI agent development frameworks, speech-to-text software, and AI-assisted coding tools such as Cursor.

Genians said the tools include Ollama, GPT4All, and Msty, and can process documents locally without sending sensitive information to external AI services. Kimsuky is integrating AI models into malware development, data analysis, and attack automation to increase the scale of its cyberattacks.

Foresight News also reported earlier that cybersecurity company Kaspersky said Kimsuky used the Durian malware in a series of attacks targeting at least two cryptocurrency companies.