North Korean state-backed threat actor Kimsuky is extending its established espionage playbook with locally hosted artificial intelligence tooling, according to new research into an activity cluster tracked as Operation GitPower.
The campaign retains familiar phishing-led intrusion chains but shows the operators preparing AI-assisted capabilities for malware development, data analysis, social engineering, and operational automation.
The operation continues to use targeted spear-phishing emails, ZIP archives containing malicious Windows shortcut files, obfuscated PowerShell loaders, scheduled-task persistence, and GitHub repositories for payload delivery and command-and-control operations.
Initial access begins with lures masquerading as government correspondence, research documents, embassy communications, honorarium forms, legal agreements, financial material, and event proposals.
Victims who open the bundled LNK file trigger a concealed PowerShell execution chain while a decoy document is downloaded and displayed, reducing suspicion as the infection proceeds in the background.
In one observed case, the LNK command line contained about 3,800 characters and hundreds of spaces designed to hide the malicious portion from the Windows shortcut-properties interface.
The loader uses Base64-encoded content, custom decoding logic, fragmented strings, and hidden PowerShell processes to frustrate static inspection.
It subsequently installs scripts under AppData, establishes a recurring hidden scheduled task, profiles the compromised host, and retrieves additional stages through GitHub’s Raw Content service.
Researchers found repositories containing RC4-encrypted .NET AsyncRAT payloads disguised as PNG image files, including names such as apple.png, rabbit.png, and wolf.png.
Genians Security Center assesses Operation GitPower as a continuation of Kimsuky activity linked to the previously documented FlowerPower campaign.
GitHub therefore serves both as a malware distribution channel and a flexible cloud-hosted C2 layer.
By rotating repository content and obscuring payloads as benign files, Kimsuky can blend malicious retrieval traffic with legitimate developer-platform activity.
The group also split URLs and repository identifiers into short strings before reconstructing them at runtime, limiting the effectiveness of straightforward URL and signature matching.
The most consequential finding, however, is evidence of a local AI ecosystem on infrastructure associated with the operation.
Investigators identified traces of Ollama, GPT4All, and Msty, three platforms that enable models to run locally rather than sending prompts or data to external AI providers.
This local approach could give an espionage operator greater control over sensitive source material, stolen documents, prompts, and development workflows.
Researchers also recovered indicators that GPT4All’s LocalDocs capability had been configured, including a localdocs_v3.db database.
LocalDocs uses retrieval-augmented generation, allowing a model to query a supplied document collection before generating answers.
In an espionage context, such a system could help operators search, prioritize, summarize, and cross-reference intelligence collected from victim environments.
Genians stressed that this represents evidence of AI integration research, not confirmed operational deployment of an AI-enabled implant.
Additional artifacts included LLaMaSharp, CUDA GPU backends, LangChain components, Microsoft Semantic Kernel, Microsoft Agents AI, OpenAI and Azure OpenAI packages, and Whisper-related speech-to-text archives.
The combination suggests active preparation for local model execution, RAG workflows, agent-based automation, external-model integration, and transcription of acquired audio material.
Korean-language AI and .NET learning materials further support the assessment that the operators are systematically building technical competence rather than conducting one-off experiments.
Kimsuky has also reportedly used generative AI to improve decoy material. Recent investment, finance, virtual-asset, and game-development lures showed consistent formatting, metadata, and template patterns consistent with automated document-generation workflows.
Such content can make traditional phishing more persuasive without changing the underlying delivery mechanism.
For defenders, Operation GitPower reinforces that AI adoption does not eliminate legacy detection opportunities.
Security teams should prioritize behavioral analytics for unusually long LNK arguments, hidden PowerShell, custom Base64 decoding, newly created scheduled tasks, GitHub Raw Content access, anomalous personal access token use, and encrypted .NET binaries masquerading as image files.
The campaign’s significance lies less in a novel intrusion vector than in its trajectory.
Kimsuky appears to be combining dependable espionage tradecraft with local AI capabilities that could shorten development cycles, scale tailored phishing, and accelerate analysis of stolen data while preserving operational control.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…