North Korean Hackers Build Offline AI Stack to Automate Malware

North Korean hacking unit Kimsuky deploys offline AI models on proprietary servers to automate malware development. South Korean security firm Genians discovered the espionage group actively running local tools like Ollama, GPT4All, and Msty to evade public chatbot monitoring. The infrastructure includes Microsoft $MSFT Semantic Kernel, OpenAI's Whisper, and Cursor to integrate AI functions directly into custom C# and .NET payloads. Researchers recovered a configured Retrieval-Augmented Generation (RAG) database, allowing the unit to query private documents entirely offline. Traditional phishing tells like clumsy formatting and stilted translations will disappear from this attack chain.