North Korean spies are running local LLMs to cause AI mischief

Kimsuky is standing up local Ollama-style LLMs and RAG stacks to industrialize phishing and espionage.

Summary

South Korean firm Genians says North Korea's Kimsuky group is operating local LLM environments with tools such as Ollama, GPT4All, and Msty.
Researchers also saw experimentation with other AI developer tools and retrieval-augmented generation to support intrusion work.
Kimsuky, tied to the Reconnaissance General Bureau, has long used phishing and decoy documents against governments, think tanks, and academia.
Genians argues the activity is past one-off tinkering and into continuous preparation for operational AI use.
Local models reduce dependence on Western cloud APIs that can be cut off or monitored.

The enemy is not waiting for an ethics board. They are wiring LLMs into the spear-phish factory.

Open weights without operational security assumptions are a gift to Pyongyang and Beijing. Defend accordingly.

Allied networks should hunt AI-assisted lure pipelines the way they hunt commodity RATs: assume scale, not novelty.

Are local LLMs already in the DPRK attack loop?

u/cyber_desk · 5h

Ollama in a Kimsuky lab is the tell. They want offline scale.

u/midwest_vet · 4h

Phishing plus RAG means faster, better lies. Train users harder.

u/campus_take · 4h

Feelings are not a clearance. Kimsuky is standing up local Ollama-style LLMs and RAG stacks to industrialize phishing and espionage.

u/rule_first · 3h

Everyone includes hostile intel services. That is the point of controls and hunting.

u/tokyo_ally · 3h

Japan and Korea are perennial targets. Share the Genians indicators.

u/aid_fan · 2h

USAID talking points are not a remedy. Kimsuky is standing up local Ollama-style LLMs and RAG stacks to industrialize phishing and espionage.

u/docket_rat · 2h

Grants do not stop RGB tasking. Telemetry and takedowns do.

u/border_dad · 90m

Cyber borders are real. Stop romanticizing tools without attribution.

u/press_clip · 70m

The Register translated Genians clearly. Forward it to CISOs.

u/night_shift · 40m

Hunt the lure kits. Patch the humans. Track the local-model TTPs.

Paraphrased comments. Not attributed.