THE OFFLINE TURN
North Korea Moves Its Artificial Intelligence In-House
A NOTE ON THE ANCHOR SOURCE
The central new disclosure in this report — that Kimsuky built and ran local large language model environments on its own command-and-control infrastructure — rests on a single vendor, Genians Security Center, publishing on 9 August 2026. Wire syndication of the story carried the explicit caveat that the findings could not be independently verified.
The evidence Genians presents is artefact-level, internally consistent, and consistent with three years of prior tradecraft attributed to the same actor. This assessment treats it as credible. It does not treat it as corroborated. Where the distinction affects a judgment, the text flags it.
BOTTOM LINE UP FRONT
On 9 August 2026 the Korean security vendor Genians published forensic evidence that operators of the North Korean state group Kimsuky had installed and executed three separate local large language model runtimes on their own command-and-control server, configured a retrieval-augmented generation database over documents in their possession, assembled a complete C# toolchain for building autonomous AI agents, and staged speech-to-text models capable of transcribing stolen audio. Genians recovered the operator’s keystrokes. One reconstructed query asks an AI system to search a document collection for wallet seed phrases, sign-up passwords, and Gmail credentials, and to be as detailed as possible.
That is the story. Its significance is not that North Korea is using artificial intelligence — that has been documented since February 2024 and is now unremarkable — but that a state actor has taken its AI capability offline, beyond the reach of the account bans, usage logging and safety filters that Western AI vendors have spent two years deploying against it. The audit trail that produced most of what this industry knows about adversarial AI use is precisely what Kimsuky has engineered away.
Set against thirty months of accumulated reporting, however, the offline turn is an adaptation rather than a breakthrough. Across every major primary disclosure in this period — Microsoft, OpenAI, Google’s Threat Intelligence Group, Anthropic, CrowdStrike, Expel and Genians itself — the finding is consistent and unglamorous: artificial intelligence has made North Korean operations faster, more numerous, more polished and accessible to less skilled operators. It has not yet given them a capability they could not otherwise obtain. Google’s own analysts, with the widest visibility of anyone, put it plainly in February 2026: they had not observed state actors achieving breakthrough capabilities that fundamentally alter the threat landscape.
Defenders should therefore resist both framings on offer. The vendor framing — an AI-accelerated adversary transforming the threat landscape — oversells a real but incremental shift. The dismissive framing — nothing new, just better phishing — misses that force multiplication at the low-skill end of a 30,000-person cyber workforce is exactly how a sanctioned state converts personnel into revenue. Both the record $2.02 billion North Korea stole in cryptocurrency in 2025 and the industrial scale-up of its fraudulent IT worker programme are consistent with a regime that has found a way to make mediocre operators productive.
The practical consequence for security teams is a shift in where detection has to live. For two years, the most reliable source of intelligence on adversarial AI use has been the AI companies themselves. Local inference removes that vantage point entirely. What remains is the endpoint and the network egress: local model runtimes appearing where they have no business being, and processes that are not browsers reaching out to inference APIs. Section 12 provides the detection content for both.
KEY JUDGMENTS
DOCUMENTED Kimsuky has built and operated local LLM infrastructure on its own attack infrastructure. Genians recovered Ollama SSH keypairs that are generated only on first execution, a GPT4All LocalDocs retrieval database, and a Msty Studio installation — three distinct approaches to offline inference, present together. The redundancy indicates systematic evaluation rather than casual experimentation. Genians itself characterises the actor as being in a research and knowledge-acquisition stage; this report adopts that framing and cautions against reporting that describes Kimsuky as running AI-driven attacks today.
ASSESSED The move offline is a direct, rational response to two years of AI vendor disruption. OpenAI, Microsoft, Google and Anthropic have collectively banned thousands of DPRK-linked accounts and published the contents of those accounts. Local inference produces no external log, no terms-of-service violation, and no vendor threat report. It is the obvious countermeasure, it is available free of charge to anyone with a consumer GPU, and it cannot be revoked. The industry should expect this pattern to propagate beyond Kimsuky.
ASSESSED Artificial intelligence is functioning as a force multiplier at the low-skill end of the DPRK workforce, not as a capability breakthrough at the elite end. Microsoft frames AI as reducing technical friction while human operators retain control of objectives, targeting and timing. Expel’s analysis of the HexagonalRodent cluster found operators who could not otherwise write code running a campaign that took roughly $12 million in three months. Anthropic found IT workers who could not pass a technical interview or write professional English without model assistance. The uplift is real and it is concentrated among people who previously could not have participated at all.
DOCUMENTED Retrieval-augmented generation over stolen material is now an operational post-exploitation technique. The presence of a configured LocalDocs database, together with a recovered operator query asking an AI system to identify exposed wallet credentials and Gmail account details within a document set, establishes that exfiltrated data is being triaged conversationally rather than manually. This compresses the interval between exfiltration and monetisation and it scales without additional headcount.
DOCUMENTED No DPRK actor has been observed training or fine-tuning its own models. Genians searched for training datasets and fine-tuned model outputs and found neither. The collected libraries — LLaMaSharp with CUDA 11 and 12 backends — would support such a transition, but the transition has not occurred. This remains the single most important capability boundary in the assessment.
WATCH Agentic AI is the next step and the leading indicators are already present. Microsoft reported in March 2026 that the Coral Sleet cluster had assembled what it described as a fully AI-enabled workflow incorporating agentic tooling. Kimsuky has collected Microsoft.SemanticKernel, Microsoft.Agents.AI and LangChain bindings. Google observed adversary experimentation with agentic frameworks in late 2025. None of this has yet been seen driving an intrusion end to end. Confirmation that it has would justify re-baselining this entire assessment.
WATCH Malware that calls an inference API at runtime is an emerging class that current detection frameworks do not describe well. HONESTCUE requests C# source code from the Gemini API and compiles it in memory, so the second stage does not exist until execution and never touches disk. PROMPTFLUX rewrites itself hourly. SesameOp uses an assistants API as a command channel. Neither MITRE ATT&CK nor ATLAS currently has a technique that cleanly captures this behaviour, which means most detection catalogues have no entry for it either.
ASSESSED AI vendor disruption remains useful but can no longer be treated as a primary control. Account bans impose cost and generate excellent intelligence. They cannot reach local inference, they are slower than account creation, and they are bypassed by translation intermediation, persona reframing and API-level access that is indistinguishable from legitimate development traffic. Defensive investment should move to the endpoint and to egress.
INFERRED The absence of significant AI tooling in the August 2025 Kimsuky operator leak, contrasted with its prominence twelve months later, suggests adoption inside this group accelerated sharply during 2026. The leaked workstation material was rich in conventional tradecraft and effectively silent on AI. The inference is drawn from an absence of evidence in a single compromised host and should be held loosely.
SCOPE, SOURCING AND METHODOLOGY
This assessment covers the integration of generative artificial intelligence and large language models into offensive cyber operations conducted by or on behalf of the Democratic People’s Republic of Korea, from the first public disclosure of such use on 14 February 2024 through 10 August 2026. It addresses espionage, financially motivated intrusion, and the fraudulent remote-employment enterprise, on the basis that all three answer to the same institutional chain and increasingly share tooling.
Sourcing posture
The evidentiary base for this subject is unusual and its limitations should be understood before the findings are consumed. Four categories of source carry the analysis, in descending order of independence:
– Vendor forensic reporting — Genians, Expel, Google Threat Intelligence Group, Microsoft Threat Intelligence, DTEX. This is artefact-level evidence: file paths, hashes, keystroke reconstructions, malware analysis. It is the strongest material available and it is also produced by companies with a commercial interest in the salience of the threat.
– AI platform disclosures — OpenAI, Anthropic, Google. These describe adversary behaviour observed inside the vendors’ own systems. They are uniquely direct and structurally incomplete: they can only report what happened on their platform, which is precisely the visibility that local inference removes.
– Government action — OFAC designations, Department of Justice indictments and sentencings, FBI advisories. Evidentiary standards are high and the material is adversarially tested in court, but publication lags the activity by one to three years.
– Research institutions and press — Chainalysis, the Committee for Human Rights in North Korea, the Stimson Center, CETaS at the Alan Turing Institute, and reporting by WIRED, TechCrunch, The Record and CyberScoop. Used for quantification, institutional context and analytic balance.
Treatment of vendor metrics
Percentage growth figures published in annual threat reports are drawn from real telemetry and are also marketing artefacts. A vendor reporting an eighty-nine per cent increase in AI-enabled adversary activity is describing changes in its own visibility as much as changes in adversary behaviour, and the denominator is never published. Such figures appear in Section 10 with attribution and are not used to support any judgment on their own.
What this report does not claim
It does not claim that North Korea has developed indigenous AI models, that AI has enabled novel exploit discovery, that AI is autonomously conducting intrusions, or that the local LLM finding has been independently confirmed. Each of these has been asserted somewhere in the coverage of the past six months. None is supported by the evidence.
THE DPRK CYBER APPARATUS AND ITS AI GOVERNANCE
North Korean offensive cyber activity is not a collection of freelance groups. It is a state programme with a defined chain of command, an explicit revenue mandate, and — since March 2025 — a dedicated research organisation for artificial intelligence. Understanding that structure explains why AI adoption has propagated across clusters that otherwise share little tooling.
The Reconnaissance General Bureau
The Reconnaissance General Bureau is the military intelligence organisation under which the regime’s clandestine external operations sit, reporting directly to Kim Jong Un. The Committee for Human Rights in North Korea released a hundred-page study of the Bureau on 23 February 2026 characterising it as a complex threat entity that fuses military reconnaissance, cyber warfare, foreign espionage, criminal enterprise, terrorism and revolutionary functions in a single organisation — a combination that has no clean Western analogue and which explains why espionage collection and cryptocurrency theft are conducted by units that share infrastructure and personnel.
SOURCING CAUTION — PERSONNEL FIGURES
Widely circulated figures placing RGB cyber personnel at approximately 12,000, rising to roughly 30,000 when research organisations are included, alongside 13 support organisations and some 4,200 supporting staff, are commonly attributed to the February 2026 HRNK study. Those specific numbers could not be confirmed against the primary document during preparation of this assessment.
They are reproduced here only to note their provenance is uncertain. Analysts citing DPRK cyber headcount should verify against the source document directly rather than against secondary reporting, and should treat any single headcount figure for a closed state as an estimate with wide error bars.
Research Center 227
In its 2025 study of the North Korean cyber syndicate, the insider-risk firm DTEX disclosed the existence of a dedicated artificial intelligence research organisation operating under the Bureau. The reporting, corroborated by in-country sourcing from Daily NK, holds that the centre was ordered by Kim Jong Un in late February 2025 and became operational on 9 March 2025, that it is located in the Mangyongdae district of Pyongyang, that it recruited approximately ninety computer specialists including top graduates from major universities and doctoral programmes, and that — unusually for a DPRK cyber organisation — it runs continuously rather than on shifts aligned to Pyongyang business hours.
Its remit is described as research and development rather than direct operations: AI-assisted generation of phishing documents and false identities, and automated exploit development, delivered as capability to the operational clusters. The distinction matters for analysis. Research Center 227 is a capability supplier; the AI use documented in fielded operations predates it and continues in parallel.
ASSESSED Research Center 227 represents institutional commitment to artificial intelligence as a strategic capability rather than opportunistic tool use by individual operators. The continuous operating tempo and the recruitment of academic specialists are consistent with a standing capability organisation. However, no public evidence links any specific observed campaign to the centre’s output, and the reporting rests principally on one vendor and one defector-informed outlet.
Why the structure matters for AI adoption
Three features of this apparatus determine how artificial intelligence spreads through it. First, the revenue mandate: units are measured on foreign currency generation, which rewards throughput and creates direct pressure to adopt anything that increases operator output. Second, the talent asymmetry: the regime can field a very large number of computer-literate personnel but a small number of genuinely elite developers, which makes tools that raise the floor more valuable than tools that raise the ceiling. Third, the sanctions environment: the same isolation that constrains access to hardware also creates institutional anxiety about dependence on foreign technology — the stated rationale, in DTEX’s account, for standing up an indigenous research capability at all.
Local inference satisfies all three conditions simultaneously. It raises operator output, it raises the floor rather than the ceiling, and it removes a foreign dependency that can be switched off. Read against the institutional logic, the offline turn documented in Section 6 is not a surprise. It is what this system was always likely to do.
THIRTY MONTHS: THE EVOLUTION OF DPRK AI ADOPTION
Adversarial AI use by North Korea has moved through three identifiable phases in thirty months. The transitions between them were driven less by advances in model capability than by defensive pressure: each phase begins roughly where the previous phase’s primary enabler was disrupted.
Phase one — experimentation on commercial platforms (February 2024 to mid-2024)
On 14 February 2024 Microsoft Threat Intelligence and OpenAI jointly published the first confirmed account of state-sponsored actors using large language models. The North Korean cluster identified was Emerald Sleet, Microsoft’s designation for Kimsuky. Its documented use was modest: researching publicly reported vulnerabilities including the Microsoft Support Diagnostic Tool flaw commonly known as Follina, drafting spear-phishing content aimed at Korean Peninsula policy specialists, and troubleshooting scripting and web technologies.
OpenAI’s contemporaneous assessment was that its models offered only limited, incremental capability for malicious cybersecurity tasks beyond what was already achievable with publicly available tooling. That judgment was accurate for what was in front of them. It has aged into a cautionary example of describing a trajectory by its starting point.
Phase two — operationalisation and vendor disruption (late 2024 to early 2026)
The second phase is defined by two simultaneous developments: AI moved from content generation into every stage of DPRK operations, and the AI companies began systematically banning and publishing.
In February 2025 OpenAI disclosed the removal of DPRK-linked accounts associated with the clusters it tracked as Velvet Chollima and Stardust Chollima, used for debugging remote-desktop brute-force tooling, working with open-source remote access trojans, cryptocurrency-related reconnaissance, and PowerShell development. In July 2025 Genians detected a Kimsuky campaign that used ChatGPT to generate a forged South Korean military identification card, assessed as a deepfake with ninety-eight per cent probability. The operators circumvented the model’s refusal to reproduce government identity documents by reframing the request as a mock-up or sample design for legitimate purposes — an early, clean example of intent laundering through prompt framing.
In August 2025 Anthropic published its own disclosure. North Korean operatives had used its models to fabricate professional identities, pass technical assessments, and then perform the actual engineering work at Fortune 500 employers. Anthropic’s characterisation was blunt: operators who could not otherwise write basic code or communicate professionally in English were passing interviews at reputable technology companies and holding the jobs afterwards, which it described as a fundamentally new phase for employment fraud. The same report documented an extortion operation in which a single actor used an agentic coding tool against at least seventeen organisations including healthcare providers, emergency services, and government and religious institutions, with demands that sometimes exceeded half a million dollars — not DPRK-attributed, but the clearest demonstration to date of what one unskilled operator with a capable model can do.
By February and March 2026 the disruption campaign was running at scale. Google disclosed Gemini abuse by the DPRK cluster UNC2970 for open-source intelligence synthesis and target profiling in support of Operation Dream Job-style approaches, alongside the first malware families to call inference APIs at runtime. Microsoft reported disrupting thousands of accounts tied to the IT worker programme.
Phase three — the offline turn (2026)
The third phase is the subject of Section 6. Its logic follows directly from the second: an actor whose accounts are banned, whose prompts are published in threat reports, and whose requests are refused by safety filters will eventually run the model where none of those things can happen. The tooling to do so is free, well documented, and requires no capability North Korea does not already possess.
OPERATION GITPOWER: TECHNICAL ANALYSIS
Genians Security Center published its analysis of Operation GitPower on 9 August 2026. The report is explicit that the activity is not a newly emerged standalone campaign but a continuation of Kimsuky operations tracked over several years, sharing characteristics with the 2023 FlowerPower campaign and with the February 2024 activity Genians reported under the name New Year Opinion Column. Its conclusion is that the actor has moved beyond one-off experimentation with artificial intelligence and is continuously preparing to integrate the technology into actual attack capability.
The campaign targets foreign diplomatic missions, military and security organisations, and the virtual asset sector. What distinguishes it analytically is not the intrusion chain, which is recognisably Kimsuky, but what investigators recovered from the operator’s own environment.
6.1 The intrusion chain
Initial access and the LNK
Delivery is by spear-phishing email carrying a ZIP archive containing a malicious Windows shortcut file. Lures observed include honorarium payment requests, legal documents, media article review requests, embassy correspondence, virtual asset and financial investment material, and — in one case with a certain irony — a document impersonating a Korean fintech platform offering AI-powered investment strategy services. One shortcut was named for the concept note of a 2026 ASEAN youth camp.
The shortcut files are constructed to survive casual inspection. They carry document icons and double extensions such as .pdf.lnk. The Windows properties dialogue reports the file as a Hangul document of 2.84 KB last modified in October 2023; the artefact is in fact a shortcut of roughly 304 KB. The command-line argument is approximately 3,800 characters long, and the operator has inserted around 300 consecutive space characters ahead of the real PowerShell so that an analyst opening the shortcut properties window sees an apparently empty argument field.
The embedded payload is Base64-encoded, but decoding does not use the standard .NET conversion method. The script implements its own character table and bitwise operations to perform the decode — a deliberate choice that defeats detection logic keyed on [Convert]::FromBase64String() and on the canonical Base64 alphabet.
Execution, decoy and download
The decoded script is written to %TEMP%\poqpwoqwdjoweij.ps1 and executed with a hidden window. It retrieves a legitimate decoy PDF and a second file, riudxkfngidruhkr.pdf, from GitHub’s raw content service. The URL is never present in the script as a contiguous string: the scheme is split into fragments concatenated at runtime, and the account and repository names are likewise assembled from short pieces. Access to the repository uses a GitHub personal access token hardcoded into the script, since revoked.
The decoy opens for the victim. From the user’s perspective a document has been received and displayed; the remainder of the chain proceeds behind it.
Persistence
An intermediate script is written to %AppData%\irujkdnjhgttrhdkfdu.ps1 and registered as a hidden scheduled task under the name ZHUYHJGTYTFSUHIPOKLKHJHUYGVHGNFH. The task first executes approximately five minutes after registration and repeats every thirty minutes thereafter. Two further scripts, %AppData%\lpieuysjfgtrja.ps1 and %AppData%\ms_update.ps1, were also recovered in the chain.
Collection
The intermediate script gathers operating system version and architecture, system configuration, machine type, installation and boot history, and the running process list. Results are written to files named on a predictable pattern combining the victim’s IP address with a timestamp — <IP>-<MMDD_HHMM>-XXX-kkk.txt in %APPDATA%, and <IP>-<MMDD_HHMM>-0956_info.txt under %APPDATA%\Microsoft — before being uploaded through the GitHub API.
Command and control, and the payload
Command and control runs through public GitHub repositories operated by the actor, holding configuration files, PowerShell scripts and payloads that are swapped as required. The payloads are stored with image file extensions — observed names include apple.png, fox.png, lion.png, rabbit.png, wolf.png and leopard.png — and are in fact RC4-encrypted .NET builds of AsyncRAT. A further artefact, rTom.exe_r, was staged alongside them. The command-and-control address 112.216.9[.]171 is located in South Korea.
OPERATIONAL SECURITY FAILURES
Genians identifies several errors that materially aided the investigation. A test IP address in the link-local 169.254.33[.]137 range was left in the tooling, indicating a lab environment. The GitHub personal access token was hardcoded in cleartext rather than fetched at runtime. And a clipboard artefact recovered from the operator’s development environment, Test-com1.json, contained a GitHub API response naming the repository owner brandonleeodd93-blip, a commit-author address brandonleeodd.93@gmail[.]com, and an infection-report filename generated from the internal test host 172.16.11[.]141.
That last artefact is the most valuable pivot in the report: it links the actor’s test environment directly to the production collection script, and it supplies a named account and email for infrastructure hunting.
6.2 The artificial intelligence findings
The intrusion chain above would be a routine Kimsuky report. What follows is not. Genians recovered the contents of the actor’s own command-and-control server, including its file system and keystroke logs, and what it found there constitutes the first well-documented case of a state cyber actor standing up local artificial intelligence infrastructure for offensive use.
Three local inference runtimes
Three separate tools for running language models offline were present and had been executed:
Genians reads the presence of all three as an important indicator that the actor did not test a single tool by chance but broadly compared and evaluated multiple approaches to running models locally. The report is equally explicit about why an actor would want this: offline operation prevents conversation data being transmitted to external AI services, which it describes as a particularly attractive property for a state-sponsored threat actor.
ASSESSED The redundancy is the finding. Any one of these tools would suffice to run a model. Installing three, including a commercial management layer, is the behaviour of an organisation conducting a build-versus-buy evaluation rather than an individual satisfying curiosity. Read alongside the agent libraries below, it indicates preparation for a durable internal capability.
Retrieval-augmented generation over stolen material
The localdocs_v3.db file is created by GPT4All only when its LocalDocs feature is configured against a set of documents. Genians describes this as direct evidence that the actor attempted to connect documents in its possession to an AI system and use them as a knowledge source.
The operational meaning of that sentence deserves to be spelled out, because it is easy to underweight. Post-exploitation triage has historically been the least scalable part of an espionage or theft operation: someone has to read the files. Retrieval-augmented generation removes that constraint. An operator can point a model at an exfiltrated corpus and ask questions of it in natural language, in their own language, and receive targeted answers in seconds.
Genians did not have to infer this use case. Keystroke forensics recovered an operator query, typed in Korean, which in translation asks the system to check whether any personal information has been exposed in the material — specifically naming wallet details including seed phrases and sign-up passwords, Gmail credentials, and site registration history — and requests that the analysis be as detailed as possible. The structure of the query, naming a subject, enumerating the items sought and requesting depth, is exactly how one prompts a retrieval system over a document collection.
DOCUMENTED Retrieval-augmented generation over exfiltrated data is an operational DPRK technique, not a theoretical risk. For defenders the implication is directional: an adversary with RAG configured over your stolen documents is actively querying them, which compresses the window between exfiltration and monetisation and removes the practical protection that previously came from the sheer volume of material stolen.
An agent development toolchain
A set of NuGet packages was recovered from Pictures\zzz\nupkg — a deliberately non-standard path. The packages span the full path from local execution through retrieval to autonomous orchestration and back out to commercial services:
Genians assesses that collecting this span of libraries together — local execution, document retrieval, automated agents, external integration — indicates purposeful tool development rather than simple curiosity. The choice of C# is itself an attribution signal: it aligns with the .NET payloads the group already deploys.
Speech-to-text
Archives containing OpenAI’s Whisper model and the faster-whisper implementation were present, together with a saved Korean-language tutorial on extracting text from audio files using faster-whisper. Genians does not report recovering transcription output. The assessed purpose is processing stolen audio — recorded calls, meetings, media — into text that can then be fed to the same retrieval pipeline as stolen documents.
AI-generated decoy documents
Since early 2026 Genians has tracked a consistent pattern of machine-generated decoy PDFs across Kimsuky campaigns. The metadata is diagnostic: the Author field reads python-docx, indicating programmatic generation, and the Creator field reads WPS 文字, the Chinese-language build of the Kingsoft WPS Office word processor. Layouts, colour schemes and table structures are consistent across unrelated subject matter, and emoji appear in title areas in a manner that mimics generative document templates but is anomalous in genuine financial material.
AN AUTOMATION FINGERPRINT WORTH GENERALISING
Two English-language decoys carried identical creation and modification timestamps: one at 05:00:04 on 11 March 2026, the other at 05:00:44 on 24 March 2026. The documents were produced two weeks apart, yet both were generated in the same forty-second window of the same hour of the day.
A human author does not produce documents on that schedule. This is a scheduled generation job. The analytic value is that it generalises: where an actor automates lure production, the timestamps of a decoy corpus will cluster tightly by time-of-day while spreading across dates. That is a testable hypothesis defenders can run against their own quarantined phishing attachments without any knowledge of the actor, and it produces a corpus-level signal that survives changes in lure content.
AI-assisted development
Multiple installers for the Cursor AI code editor were recovered from the downloads folder, and logs show the tool in active use — editing a requirements document named for an attack-and-defence exercise against a cryptocurrency platform, and reviewing the JSON artefact discussed above during testing of the GitHub command-and-control channel. This connects directly to Expel’s independent findings on the HexagonalRodent cluster, where Cursor featured in the same role.
6.3 Attribution
Genians presents four independent lines of attribution. Taken together they are strong; taken individually, two of the four are weaker than they first appear and are worth disaggregating.
Linguistic
Keystroke logs captured English key values, which investigators reconstructed into Korean using the KS X 5002 Dubeolsik layout — the South Korean standard. North Korea uses a different standard, KPS 9256, but operators working on Korean-language Windows builds will commonly use the southern layout, so the layout itself is not the indicator.
The indicator is orthography. The reconstructed text contains North Korean spellings that differ systematically from South Korean standard forms, including 싸이트 for 사이트 (site), 리력 for 이력 (history or record), 로출되였는지 for 노출되었는지 (whether exposed), and 리용 for 이용 (use). These reflect the divergent orthographic conventions of the two Koreas, and they persisted through the operator’s own backspace corrections — the operator corrected other errors while leaving these forms intact, which indicates internalised habit rather than typing error. This is the strongest single attribution signal in the report.
Behavioural
Two operator prompts were reconstructed in full. The first asks how to disable the reporting feature in Microsoft Defender. Notably, it was typed in Korean, passed through Google Translate into English, and then pasted into a ChatGPT session in Chrome — investigators observed the paste and return keystrokes. The workflow suggests a deliberate preference for English prompting, plausibly for better technical results, and incidentally demonstrates a bypass path around Korean-language content filtering. The second is the retrieval query over stolen credentials described above. Additional recovered searches concern cryptocurrency user enumeration and document-based exploitation techniques.
Environmental
The host reported its system manufacturer as Arirang, a North Korean consumer device brand with no South Korean PC manufacturing presence. Astrill VPN was in use, a service repeatedly associated with DPRK IT worker activity. The Chinese-language build of WPS Office 2019 was used to open an agreement document, consistent with the Creator metadata on the generated decoys. AnyDesk was present for remote access.
Genians is appropriately careful with the Arirang indicator, treating it as contextual rather than conclusive. A system manufacturer string is trivially modifiable and its presence in a virtualised or repurposed environment proves less than it appears to. It corroborates; it does not carry attribution on its own.
Technical
Payloads were recovered whose RTF headers had been manipulated and which, when the original Gzip magic bytes were restored, decompressed correctly — an idiosyncratic technique identical to that documented in the February 2024 New Year Opinion Column campaign already attributed to Kimsuky. This is the tradecraft continuity that anchors the campaign to the group.
By contrast, the shortcut builder used was matched to a command-line LNK generation tool published on GitHub in September 2023. Genians notes correctly that use of a public tool carries limited attribution value. Analysts should not weight it.
DOCUMENTED Attribution to Kimsuky is sound and rests principally on two independent legs: North Korean orthographic patterns persisting through self-correction, and RTF header manipulation identical to previously attributed campaigns. The environmental indicators corroborate. The tooling lineage does not, and should be discounted.
6.4 What Genians did not find
The report is as valuable for its negative findings as its positive ones, and these are consistently underreported in coverage of the disclosure.
– No model training or fine-tuning. Investigators searched for training datasets and for model files produced by training, and found neither. Genians states explicitly that the observed activity had not progressed to training new models.
– No identification of which models were loaded. The contents of models3.json, which would name the models in use, were not published. Ollama supports Llama, Mistral, Gemma, Qwen and DeepSeek among others. Claims circulating that Kimsuky is running Chinese open-weight models are not supported by the published evidence.
– No agentic deployment. The agent frameworks were staged, not observed in operation. There is no evidence in this report of an AI agent conducting any part of an intrusion.
– No evidence that AI improved the intrusion chain itself. The GitPower attack chain is conventional Kimsuky tradecraft. The AI capability sits alongside it — in lure production and post-exploitation processing — not inside it.
WATCH The integration-to-training boundary is the single indicator most worth monitoring. Models fine-tuned on stolen organisational data — internal terminology, reporting lines, document conventions — would produce social engineering that is materially harder to detect than anything a general-purpose model can generate. The libraries and GPU backends already collected would support that transition. Watch for compute acquisition inconsistent with inference workloads, exfiltration patterns optimised for corpus construction rather than immediate value, and model weight files appearing in command-and-control infrastructure.
THE WIDER ECOSYSTEM: AI ADOPTION BY GROUP
Adoption is uneven across the DPRK clusters. Mapping it by group clarifies where the capability actually sits and, more usefully for defenders, which sector faces which variant of the threat.
Kimsuky — Emerald Sleet, Velvet Chollima, APT43
The most advanced adopter and the only DPRK cluster with confirmed local inference infrastructure. Its documented AI use now spans commercial platforms for target research, phishing content, deepfake credential forgery and vulnerability research; local runtimes for offline operation; retrieval-augmented generation over stolen material; speech-to-text on stolen audio; automated decoy generation; AI-assisted development in Cursor; and staged libraries for agent construction. Targets are diplomatic missions, military and security organisations, policy institutions and academia, and increasingly the virtual asset sector.
UNC2970 — Diamond Sleet, Lazarus subcluster
Documented by Google using Gemini to synthesise open-source intelligence and profile high-value targets in the defence and cybersecurity sectors, including mapping specific technical roles and compensation data to support the fraudulent job-offer approach known as Operation Dream Job. This is reconnaissance augmentation: the model is doing analyst work, not operator work. Aerospace, defence and energy organisations should read this as target-package preparation against their own staff.
HexagonalRodent — Famous Chollima subcluster
Expel’s April 2026 analysis is the most instructive single case study in this report because it isolates the force-multiplication effect cleanly. The cluster exfiltrated 26,584 cryptocurrency wallets from 2,726 infected developer systems and took approximately twelve million dollars in the first three months of 2026, operating with thirty-one individuals organised into six teams. The malware — BeaverTail, InvisibleFerret and OtterCookie — was written with ChatGPT, Cursor and the design tool Anima, in a workflow the researchers describe as vibe coding.
Two details matter more than the theft figure. First, the artefacts of machine authorship were visible in the code: thorough English-language comments, atypical for operators working in Korean, and emoji embedded in source — a pattern Microsoft independently observed in OtterCookie, where success and error states were marked with tick and cross emoji and comments read conversationally. Second, and more sophisticated, the operators fed their own malware back into commercial models and asked them to audit it, deliberately hardening their backdoors against detection after earlier campaigns were burned. That is a feedback loop, and it is the most operationally mature use of commercial AI documented in this period.
The researcher who surfaced the cluster made the central point himself: its significance is not sophistication. The group was not capable of this work unaided.
Jasper Sleet and Coral Sleet — the IT worker clusters
Microsoft’s March 2026 reporting documents the most complete AI dependency of any DPRK activity. Jasper Sleet uses face-swapping software to insert operators’ faces into stolen identity documents and to generate résumé headshots, and voice-changing software during interviews. Coral Sleet has assembled what Microsoft describes as a fully AI-enabled workflow incorporating agentic tooling, and has jailbroken commercial models to generate payloads. Generative adversarial networks are used to produce look-alike domains for supporting infrastructure.
Famous Chollima and Stardust Chollima
CrowdStrike’s 2026 reporting records DPRK-nexus incidents rising by more than 130 per cent year on year, with Famous Chollima activity doubling and characterised as the most generative-AI-proficient adversary the vendor tracks. Its 2026 Threat Hunting Report adds a development that inverts the usual framing: Stardust Chollima poisoned 131 npm packages belonging to an AI agent framework in June 2026, and compromised a widely used HTTP client package in March 2026. The AI supply chain is now a target as well as a tool.
AI-INTEGRATED MALWARE: A COMPARATIVE BASELINE
A genuinely new malware class emerged in late 2025: code that calls a language model at runtime as part of its own execution. Because the DPRK examples are best understood against non-DPRK ones, this section deliberately includes families attributed elsewhere.
HONESTCUE
Documented by Google in February 2026 and associated with DPRK activity overlapping UNC2970, HONESTCUE is a downloader that sends prompts to the Gemini API, receives C# source code in response, and compiles and executes that code in memory using the .NET runtime compiler. The second stage therefore does not exist as an artefact until the moment of execution, is never written to disk, and can differ on every run.
The defensive implication is specific. Static analysis has nothing to analyse. Network signatures see a TLS session to a legitimate, widely used API endpoint. Google notes the family hides within legitimate encrypted API traffic, which means the detection has to be made at the endpoint, on the behaviour — not on the wire, on the content.
PROMPTFLUX, PROMPTSTEAL and PROMPTLOCK
Google’s November 2025 disclosure was the first to document AI-enabled malware in operational contexts. PROMPTFLUX is a VBScript dropper that calls Gemini roughly hourly to rewrite and re-obfuscate itself; Google assessed it as in development and testing, with no victim compromise observed. PROMPTSTEAL — tracked by Ukraine’s national CERT as LAMEHUG and attributed to the Russian state cluster APT28 — was, by contrast, deployed live against targets in Ukraine, generating commands via a hosted model rather than carrying them hardcoded. PROMPTLOCK is a ransomware proof of concept in the same idiom.
Including the Russian example is deliberate. It establishes that runtime model invocation is a cross-actor technique rather than a DPRK specialism, and it means detection engineering for this class pays off against more than one adversary.
SesameOp
Disclosed by Microsoft in November 2025, SesameOp is a backdoor that uses a commercial assistants API as its command-and-control channel. Tasking is retrieved from, and results returned through, an API that virtually every enterprise now permits. It is the logical endpoint of the trend: the model provider becomes the dead drop.
ASSESSED This class breaks two assumptions that most detection programmes still rest on: that malware has a stable artefact which can be hashed, and that command-and-control traffic goes somewhere unusual. Neither holds. Organisations that have not yet defined an egress policy for inference APIs — which endpoints are permitted, from which processes — have no coverage for any family in this table.
THE IT WORKER ENTERPRISE AND THE ENFORCEMENT RESPONSE
The fraudulent remote-employment programme is where artificial intelligence has had its clearest measurable effect on North Korean revenue, and it is the threat most likely to reach organisations that consider themselves outside the espionage target set. It is also, uniquely in this report, an area where enforcement has produced hard evidentiary records.
How AI changed the economics
The scheme predates generative AI. What AI changed is the conversion rate. Anthropic’s finding — that operators unable to write basic code or communicate professionally in English were passing technical interviews at reputable technology firms and then holding those positions — describes a step change in the proportion of available personnel who can be placed. Microsoft’s documentation of face-swapping into stolen identity documents, AI-generated headshots, and voice modification during interviews describes the same effect on the identity side.
The result is a pipeline in which the binding constraint is no longer operator capability but the supply of usable stolen identities and willing domestic facilitators — which is precisely where enforcement has concentrated.
The enforcement record
What this means for hiring organisations
Treat this as an insider risk problem with a pre-employment component, not as a fraud problem. Three controls do most of the work:
1. Liveness verification in interviews. Real-time face swap and voice modification are now standard tooling for these clusters. Interview processes should include unscripted physical challenges that current real-time pipelines handle poorly, and interviewers should be briefed on what to look for rather than left to intuition.
2. Hardware-bound authentication. The laptop farm model depends on remote access to a device physically located in the country of employment. Phishing-resistant hardware tokens bound to a specific device break that model in a way that no amount of AI-assisted persona work can restore.
3. Identity-based detection after onboarding. Microsoft’s published hunting logic for this threat keys on sign-ins from unmanaged devices with elevated risk scores and absent device names, correlated with impossible travel. This is conventional identity monitoring applied to a specific pattern, and it is available to any organisation with an identity provider that logs properly.
QUANTITATIVE ANALYSIS
Three quantitative angles are worth holding separately, because they answer different questions and carry very different evidentiary weight: money, which is measured on-chain and is the most reliable; volume, which is measured in vendor telemetry and is the least; and automation signatures, which can be measured by defenders themselves.
Money
Chainalysis reported in December 2025 that North Korean actors stole at least $2.02 billion in cryptocurrency during 2025 — $681 million more than 2024, a 51 per cent year-on-year increase, and the most severe year on record. DPRK operations accounted for a record 76 per cent of all service compromises. Cumulative losses attributed to the DPRK now stand at approximately $6.75 billion.
Volume
Vendor-reported growth metrics for the period include DPRK-nexus incidents rising more than 130 per cent, AI-enabled adversary activity rising 89 per cent, Famous Chollima operational volume doubling year on year, and fake-CAPTCHA and ClickFix-style lures rising more than 500 per cent. CrowdStrike additionally reports an eCrime breakout time of 29 minutes, with a fastest observed case of 27 seconds.
These figures are drawn from real telemetry and are simultaneously a function of expanding sensor coverage, improved classification of AI-related activity, and the commercial incentive to report acceleration. No denominator is published for any of them. They are directionally useful and individually unciteable as evidence of adversary behaviour.
THE COUNTER-CASE: IS AI ACTUALLY TRANSFORMATIVE?
The prevailing narrative around this subject is that artificial intelligence is transforming state cyber operations. That narrative is produced predominantly by companies selling either AI or defences against it. It deserves adversarial testing, and the strongest arguments against it come from sources with excellent visibility and no incentive to understate.
The case that the uplift is marginal
– Google Threat Intelligence Group, which observes adversary use inside Gemini directly, stated in February 2026 that it had not observed state or influence actors achieving breakthrough capabilities that fundamentally alter the threat landscape. Its January 2025 assessment described productivity gains rather than novel capability. This is the single most authoritative counterweight available, because GTIG has both the visibility to know and the commercial incentive to say otherwise.
– The US intelligence community, in September 2025 briefing material, characterised AI as a malign influence accelerant rather than a revolutionary influence tool.
– CETaS at the Alan Turing Institute found no observed increase in genuinely novel malware following the release of frontier models, and located the real uplift in social engineering and in lowering the barrier to entry for less capable actors.
– Red Canary concluded that AI-powered threats do not require revolutionary new security approaches, and that the fundamentals remain determinative.
– Expel’s own researcher, describing the HexagonalRodent cluster, emphasised that its significance was not sophistication — the operators lacked the skills to write code or build infrastructure and AI enabled work they otherwise could not have done at all.
The case that it matters anyway
Three things are true simultaneously, and holding all three is the correct analytic position.
First, no documented case exists in which artificial intelligence gave a North Korean actor a capability it could not otherwise have obtained. Every observed use — phishing content, target research, code generation, identity fabrication, document triage — was achievable before, by someone with more skill or more time.
Second, that framing understates the effect, because for a sanctioned state the binding constraint has never been what its best people can do. It is how many people can be made productive. A regime with a large computer-literate population and a small elite converts AI into revenue precisely by raising the floor. Thirty-one operators who could not write code taking twelve million dollars in a quarter is the proof of concept.
Third, and most consequential for defenders, the shift to local inference degrades the intelligence supply itself. Almost everything the industry knows about adversarial AI use came from AI vendors observing it on their own platforms. That visibility does not extend to a model running on a server in Pyongyang. The threat may be evolutionary; the collection problem it creates is not.
ASSESSED Artificial intelligence has increased the throughput, polish and accessibility of DPRK operations without yet granting novel capability. The correct posture is neither alarm nor dismissal but re-instrumentation: the reason to invest in local-inference and egress detection is not that AI has produced a new class of attack, but that it has moved an existing class of activity outside the sensors that were reporting on it.
OUTLOOK AND WARNING INDICATORS
Six to twelve months
– Local inference propagates beyond Kimsuky. The technique is free, documented and effective against the primary source of intelligence on this threat. Expect other DPRK clusters, and non-DPRK state actors, to adopt it. Assessed.
– Retrieval-augmented triage becomes standard post-exploitation practice. The efficiency gain is too large to remain confined to one group. Assessed.
– Automated lure generation scales. The pipeline signature is already visible; industrialisation is the obvious next step. Assessed.
– Runtime-invocation malware becomes more common as detection remains immature. Inferred.
Twelve to twenty-four months
– Fine-tuning on stolen organisational data. The highest-consequence plausible development. Models tuned on an organisation’s own documents produce social engineering that current user training does not prepare people for. Watch.
– Agents operating portions of the intrusion chain autonomously. Frameworks are staged; Microsoft has reported one cluster with agentic components. Deployment has not been observed. Watch.
– Real-time deepfake social engineering beyond the interview context. Voice and video manipulation is already operational in hiring fraud; extension to vishing against helpdesks and finance functions is the natural progression. Watch.
Considered unlikely in the coverage horizon
– AI-discovered zero-day exploitation by DPRK actors. Current models do not reliably produce novel exploits, and no DPRK cluster has demonstrated the research capability that would make such tooling useful. Assessed as unlikely.
– Indigenous models trained from scratch. Compute and data requirements sit outside what sanctions currently permit. Assessed as unlikely.
INTELLIGENCE GAPS
The following are stated explicitly because their absence shapes the confidence attached to everything above.
1. The local LLM finding is uncorroborated. One vendor, no independent confirmation, and wire syndication carrying an explicit caveat to that effect. It is credible and it is not confirmed.
2. Which models Kimsuky loaded is unknown. The file that would answer this was recovered but its contents were not published. Assertions that Chinese open-weight models were used are unsupported.
3. The published indicator set is partial. Full hash, domain and email indicators sit in the report’s appendix material rather than the public body. Indicators in Appendix A should be treated as non-exhaustive.
4. RGB personnel figures are unverified. Widely cited headcounts could not be confirmed against the primary document.
5. No output from Research Center 227 has been publicly linked to a specific campaign. The organisation’s existence is reasonably well sourced; its operational product is not.
6. The relationship between the August 2025 operator leak and the August 2026 findings is unresolved. The leaked material showed little AI tooling. Whether this reflects rapid subsequent adoption, compartmentalisation between operators, or the limits of a single compromised host cannot be determined from open sources.
7. Effectiveness of AI vendor disruption is unmeasured. Account ban counts are published; the resulting reduction in adversary output is not, and probably cannot be.
8. No public dataset exists on whether AI-generated lures actually convert better. The assumption that AI improves phishing efficacy is universal in this literature and, as far as this assessment could establish, unmeasured.
A APPENDIX A — INDICATORS OF COMPROMISE
Indicators below are drawn from the published body of the Genians Operation GitPower report and the related July 2025 deepfake military identification campaign. This set is not exhaustive: full hash, domain and email indicator tables were placed in the source report’s appendix material rather than its public body. Validate against current infrastructure before operational deployment; the GitHub personal access token referenced in the campaign has been revoked and associated repositories may have been removed.
This assessment is compiled entirely from open sources. All confidence markers follow the ICD 203 lexicon as defined in Section 3. Indicators should be validated against current infrastructure before operational deployment. Judgments reflect the evidentiary picture as at 10 August 2026 and are subject to revision against the tripwires set out in Section 13.