On August 10, 2026, South Korean cybersecurity firm Genians Security Center published findings that represent a first in documented threat intelligence: a state-sponsored APT group — Kimsuky, operating under North Korea's Reconnaissance General Bureau — has built and is operating a self-hosted large language model environment on its own attack infrastructure. Running Ollama, GPT4All, and a retrieval-augmented generation pipeline trained on stolen documents, Kimsuky is using AI not as a novelty but as an operational capability integrated across its attack chain.
The campaign, tracked as Operation GitPower, delivers AI-generated decoy documents via ZIP archives containing weaponized LNK files. GitHub and GitLab repositories serve as both payload distribution channels and C2 infrastructure, hosting RC4-encrypted .NET AsyncRAT payloads disguised as image files. The traffic blends into legitimate developer activity.
Two things make this analysis different from the standard Kimsuky coverage. First: the metadata detection gap — AI-generated documents leave forensic traces in file metadata that are currently unaddressed by any email security rule. Second: the Russia connection. The November 2024 Comprehensive Strategic Partnership Treaty between North Korea and Russia includes explicit provisions for cooperation in AI and information security. On July 28, 2025, security monitoring systems detected a shared IP address linking Gamaredon (Russian FSB) and Lazarus (North Korean RGB). These are not parallel threats. They are a connected ecosystem.
Kimsuky has operated since at least 2012, consistently targeting South Korean government entities, think tanks, academics, and defense-related organizations. What has changed in 2026 is the scale and quality of that targeting — specifically, the quality of the lure documents used to deliver the payload.
North Korea is now running Ollama, GPT4All, and a retrieval-augmented generation pipeline on its own attack infrastructure. The decision to build locally is a deliberate OPSEC decision.
Analyst observation: Every nation that handles state secrets has the same problem with commercial AI: the model is hosted by a foreign company in a foreign jurisdiction. Using OpenAI or Anthropic to generate phishing lures would mean sending that content to US servers. North Korea building its own local LLM is the same sovereignty logic that drives Eastern European governments to run their own Zimbra servers instead of using Gmail — except in this case, the data being protected is an active espionage operation. The same infrastructure sovereignty argument that made RoundPress victims vulnerable is driving Kimsuky's AI build.
The RAG pipeline is the specific capability worth understanding. RAG allows the LLM to search a local document database before generating output. Kimsuky's database is built from stolen documents. When the AI generates a phishing lure targeting a South Korean policy researcher, it draws on real policy documents, real organizational structures, real personnel names, and real project terminology stolen from previous operations. The lure is not generic AI output. It is AI output trained on the victim's own organizational reality.
In my analysis of Russia's Signal campaign, I described the approach as exploiting structural gaps — the patch cycle failure, the sovereignty trap, the distance between what a system is supposed to do and what humans actually do with it. RoundPress worked because organizations chose self-hosted email for sovereignty and could not maintain it. The human did not do anything wrong. The infrastructure did.
Kimsuky's approach is different. North Korea needs you to do something — open a file, run a script, believe what you are receiving is real. The AI-generated lure is the latest evolution of a consistent strategy: make the bait indistinguishable from legitimate content so the target cooperates willingly. Russia finds the gap in infrastructure. North Korea finds the gap in human perception. Two nation-states, same objective, completely different philosophies about where the vulnerability lives.
What has changed in 2026 is that these are no longer parallel operations.
Documented coordination: On July 28, 2025, security monitoring systems detected IP address 144.172.112.106 linking Gamaredon (Russian FSB) and Lazarus Group (North Korean RGB) — the same day Moscow and Pyongyang announced new direct passenger flights. The November 2024 Comprehensive Strategic Partnership Treaty includes explicit provisions for mutual defense in cyberspace and cooperation in artificial intelligence. The North Korean Reconnaissance General Bureau reorganized in 2026 while senior officials increased contacts with Russian security institutions. This is not inference. It is documented coordination.
Philosophy: Find the gap between what the system should do and what humans actually maintain.
RoundPress: Self-hosted Zimbra chosen for sovereignty, left unpatched. The exploit fires on email open. No mistake required from the target.
AI use: Accelerating CVE discovery — finding the next zero-day faster than defenders can patch the previous one.
Philosophy: Make the bait so convincing the target cooperates willingly. The infrastructure is fine. The human is the target.
Operation GitPower: AI lures trained on stolen data from the target's own organization. Opens because it looks exactly like what they expected.
AI use: Generating lures at scale, RAG pipelines on stolen documents, improving with each successful operation.
The treaty covers cooperation in science, technology, information security, and AI. If Kimsuky's local LLM capabilities were informed by Russian technical expertise — and Russian CVE discovery is accelerating with AI assistance — the two approaches are converging toward a combined threat model where the infrastructure gap and the human perception gap are exploited simultaneously by actors sharing tools and intelligence.
attachment_pdf_malicious_creator_juliep.yml. The same capability can detect AI-generated documents: known local LLM tool strings (Ollama, GPT4All), completely absent metadata on unsolicited attachments, internally inconsistent metadata, or language/locale mismatch between claimed creator tool and document text. Zero email security rules currently target any of these signals.raw.githubusercontent.com link in the email body. This combination is highly anomalous — a legitimate developer communication does not arrive as a ZIP containing a shortcut file alongside a GitHub raw link. The detection signal exists and is currently uncaptured.The standard recommendation against spearphishing — train your employees to recognize suspicious emails — does not apply to AI-generated lures indistinguishable from legitimate communications. The recommendations below address what actually works.
attachment_pdf_malicious_creator_juliep.yml rule demonstrates that PDF creator metadata is readable and actionable at the email delivery layer. The same capability should extend to AI-generated document signatures: known local LLM tool strings, completely absent metadata on unsolicited attachments from new senders, and internally inconsistent metadata fields. A companion detection rule targeting these signals is in development.raw.githubusercontent.com in the minutes immediately following an email attachment opening — particularly when the email contained a ZIP — should be treated as a high-priority indicator. SIEM correlation rules joining email gateway logs with proxy or DNS logs can surface this pattern without requiring real-time blocking of GitHub traffic.Every analysis of AI-enabled phishing arrives at the same conclusion: the traditional detection signals are eroding. Poor grammar is gone. Generic content is gone. Formatting inconsistencies are gone. What remains is behavior — the LNK file that executes PowerShell, the shortcut that spawns a shell, the GitHub connection that follows the document open. Behavior does not improve because the lure improved.
The metadata signal is what this analysis adds to that picture. AI tools leave traces. Local LLM environments leave different traces than commercial tools — or leave no traces at all, which is itself a trace. A PDF with completely absent metadata from an unsolicited sender is not normal. Genians found forensic metadata evidence of AI generation in the Operation GitPower documents. That evidence exists because nobody thought to clean it.
The Russia-North Korea dimension is the one I find most significant for the long term. The Signal campaign was Russia finding the gap in human behavior. RoundPress was Russia finding the gap in infrastructure maintenance. Operation GitPower is North Korea finding the gap in human perception. These are not competing approaches. They are complementary ones — and the actors deploying them have signed a treaty, shared infrastructure, and are operating in the same geopolitical moment with the same adversary in mind.
The metadata detection gap can be addressed now, at the email delivery layer. The Julie P. rule exists because someone found a consistent creator field value and built a rule around it. The same approach applied to AI tool signatures is the next step.
September 2026 update — Campaign confirmation via ArgusX OTX: Operation GitPower remains active. ArgusX threat intelligence (OTX, September 7, 2026) confirms 13 new LNK variants collected August 11-19 with significant campaign evolution: AI-generated decoys now produced using the opencode AI coding agent with HeadlessChrome PDF conversion — placeholder text left unreviewed in the generated documents is a detectable forensic artifact. Pastebin added as backup C2 alongside GitHub PAT-based raw content retrieval. Anti-VM routines detecting virtualization tools added. Persistence established via hidden scheduled tasks masquerading as BitLocker and MATLAB. Despite increased sophistication, the core GitHub PAT-based C2 pattern remains unchanged and detectable.
This analysis is based on publicly available information including Genians Security Center's Operation GitPower report (August 10, 2026), Royal United Services Institute research on DPRK-Russia cyber cooperation (March 2026), Chainalysis cryptocurrency laundering analysis (June 2025), CSIS analysis of North Korean cyber operations (April 2025), GBHackers reporting on Gamaredon-Lazarus infrastructure overlap (November 2025), and the Russia-DPRK Comprehensive Strategic Partnership Treaty (November 2024). The Russia-North Korea coordination section is based on documented events and does not represent speculation about unconfirmed operational details. A companion detection rule targeting AI-generated document metadata signals is in development. This analysis represents independent research produced as a contribution to the security community.
I'm a security researcher in Connecticut. Analysis is the part I love: tracing threat actor behavior, pulling apart supply chain attacks, and following evidence even when it lands on "unknown." When a question needs a tool that doesn't exist, I build it; most of the tools on this site started that way. Before security I spent 15 years designing enterprise software, which is why my tools assume a human will actually have to use them. I contribute detection rules to Sublime Security's open-source production ruleset. Security+ in progress. Everything here is independent work, shared as a contribution to the security community.