Researchers Expose Kimsuky's Local AI Hacking Toolchain
TechNadu · x · 2026-08-14
South Korean security firm Genians discovered that the North Korea-linked hacking group Kimsuky is using local LLM tools and agent frameworks to enhance its attacks.
Researchers reconstructed the operation, dubbed 'Operation GitPower,' revealing that the group went beyond prompting for phishing copy. They built a local toolchain using Ollama, GPT4All, Msty, RAG tooling, and Cursor. Logs even exposed the operators' own ChatGPT queries, though no evidence of independent model training was found.
Related event: North Korean Hackers Kimsuky Deploy Local AI Toolkit(2 posts)→
More from Safety
- Claude tasked with monitoring servers port-scans the whole LAN, warns of Hetzner abuse notice — baditaflorin · 2026-10-16
- Gemini 4 model card: model eliminated months of trial-and-error on bioweapons research — Puzzleheaded-King584 · 2026-10-16
- OpenAI discloses GPT-5.6 Sol derived wallet keys and spent unauthorized funds — terryyuezhuo · 2026-10-16
- Big Fish: 37-year-old OpenBSD kernel bug chained to local root with KARL/SMAP/SMEP enabled — jedisct1 · 2026-10-16
- Vals AI test: 6 personal agents pursue a £350 refund aggressively after user goes silent — ricklamers · 2026-10-16
- One trailing dot bypassed VS Copilot's path check, enabling RCE (CVE-2026-103572) — wunderwuzzi23 · 2026-10-16