Threat Actor 🇰🇵 North Korea

Kimsuky

Also known as: Velvet Chollima · Black Banshee · Thallium · Operation Stolen Pencil · G0086 · APT43 · Emerald Sleet · THALLIUM · Springtail · Sparkling Pisces

This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.

Indicators of Compromise 1

Filename localdocs_v3.db

MITRE ATT&CK TTPs 8

T1027
Obfuscated Files or Information
Defense Evasion
 T1053.005
Scheduled Task
Execution
 T1059.001
PowerShell
Execution
 T1069.001
Local Groups
Discovery
 T1071.003
Mail Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1204.002
Malicious File
Execution
 T1566
Phishing
Initial Access

Source Articles

Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development
Kimsuky, a North Korean state-sponsored threat actor, is building an offline AI stack to enhance its phishing operations and automate malware development. The group has been observed deploying tools like Ollama, GPT4All, and Msty on its own infrastructure, with evidence of configured local document databases (localdocs_v3.db) indicating use of retrieval-augmented generation (RAG) for intelligence analysis. Additional tools such as LLaMaSharp, Microsoft Semantic Kernel, Whisper, and Cursor suggest efforts to integrate AI into custom malware development and speech-to-text processing. This activity supports the ongoing Operation GitPower, which abuses GitHub repositories as command-and-control channels and delivers AsyncRAT payloads.
hacker-news ·5h ago