#kimsuky — Public Fediverse posts on home.social

OTX Bot @[email protected] · 2026-08-10 · 16:02 UTC

Integrating AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM

The Kimsuky threat group has integrated artificial intelligence capabilities into its attack operations, establishing local large language model environments using Ollama, GPT4All, and Msty. Evidence indicates the group is accumulating technologies to incorporate AI across attack operations, including AI-generated decoy documents and retrieval-augmented generation for document analysis. The campaign, dubbed Operation GitPower, continues targeting foreign diplomatic missions and sectors including military, security, and virtual assets. Attacks utilize malicious LNK files contained in ZIP archives, executing obfuscated PowerShell scripts that abuse Git-based repositories as command-and-control infrastructure. The group distributes encrypted AsyncRAT payloads disguised as image files through GitHub. Linguistic indicators including North Korean vocabulary patterns such as "싸이트", "가입리력", and "로출되였는지" support attribution to North Korean state-sponsored operations under the Reconnaissance General Bureau.

Pulse ID: 6a79d612a1f9e2ac4e744aa8
Pulse Link: https://otx.alienvault.com/pulse/6a79d612a1f9e2ac4e744aa8
Pulse Author: AlienVault
Created: 2026-08-10 13:45:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AsyncRAT #CyberSecurity #GitHub #InfoSec #Kimsuky #Korea #LNK #Military #NorthKorea #OTX #OpenThreatExchange #PowerShell #RAT #UK #ZIP #bot #AlienVault

#asyncrat #cybersecurity #github #infosec #kimsuky #korea

OTX Bot @[email protected] · 2026-08-10 · 11:07 UTC

Kimsuky Uses Local LLMs, AI-Generated Lures and GitHub C2 to Deploy AsyncRAT

Indicators extracted from public reporting. Source: https://www.genians.co.kr/en/blog/threat_intelligence/kimsuky_ai_llm

Pulse ID: 6a79ac473fe6b48d51cf0725
Pulse Link: https://otx.alienvault.com/pulse/6a79ac473fe6b48d51cf0725
Pulse Author: CyberHunter_NL
Created: 2026-08-10 10:47:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AsyncRAT #CyberSecurity #GitHub #HTTP #HTTPS #InfoSec #Kimsuky #OTX #OpenThreatExchange #RAT #RCE #UK #bot #CyberHunter_NL