Researchers found Kimsuky’s local AI stack and reconstructed its own ChatGPT queries

Genians has published an interesting look at how Kimsuky appears to be incorporating existing AI technology into its operations.

Researchers found infrastructure containing tools for running models locally, including Ollama, GPT4All, and Msty, as well as RAG document search, AI agent development frameworks, speech-to-text software, and Cursor.

Importantly, Genians says it found evidence that tools were configured and used rather than simply downloaded. It did not, however, find evidence that Kimsuky was independently training models.

There are a few particularly interesting operational details.

Researchers found finance and cryptocurrency-themed decoy documents that appeared to have been AI-generated. Metadata from two documents reportedly showed creation timestamps roughly 40 seconds apart despite the documents being produced about two weeks apart, which Genians interpreted as evidence of a scheduled automated generation pipeline.

The researchers also reconstructed operator keystrokes and compared them with translation logs. One recovered query asked how to disable the Report feature in Microsoft Defender.

Separate logs showed translated English being pasted into a Chrome window titled “ChatGPT,” suggesting operators were also using a commercial chatbot for technical assistance rather than relying exclusively on their local setup.

The broader Operation GitPower campaign involved LNK files, PowerShell, GitHub-based infrastructure, and encrypted AsyncRAT payloads.

The interesting question is not whether AI suddenly makes Kimsuky autonomous. The evidence instead suggests an established espionage operation experimenting with where existing AI tools can reduce manual work across phishing, document processing, technical assistance, and potentially attack automation.

Which part of this workflow would you expect to give an established APT the largest practical productivity gain?