Kimsuky's local LLM stack: no vendor will flag it

Most corporate AI risk planning quietly assumes the model vendor is a control point — that OpenAI or Anthropic will catch the abuse, ban the account, and hand over the logs. A report published August 10 removes that assumption. South Korean security firm Genians found that the North Korea–linked crew Kimsuky is running its own local LLM stack on the same servers it uses to collect stolen data.

What actually happened

Genians Security Center documented three local model runtimes on infrastructure tied to the campaign: Ollama, GPT4All, and Msty. Alongside them: retrieval-augmented generation tooling for searching documents, AI agent frameworks, speech-to-text software, and the AI coding tool Cursor.

The decoy documents were the visible half. Genians found finance- and crypto-themed lures — fake investment reports and workplace files — that appear to have been generated with AI and are formatted to pass as legitimate.

Genians' own assessment is the line worth reading twice: the actor is "moving beyond one-off experimentation with AI and is continuously preparing to integrate the technology into actual attack capabilities." The firm places the group in a capability-acquisition phase — assembling existing open models, not training new ones. The findings were picked up by Al Jazeera and The Hacker News the same day.

Why local models matter for your business

Every control you associate with commercial AI lives on the vendor's side of the API: rate limits, refusals, abuse detection, account bans, retained logs a court can reach. Pull an open-weight model onto a box you own and none of that exists. There is no key to revoke and no telemetry to subpoena. RAG on local files means the stolen documents never leave the attacker's machine to get analyzed.

Practically, this kills the last cheap defense. Broken grammar and off-register formatting were free signals for a decade; they are gone. A crew that can run speech-to-text over stolen calls and generate a polished investment report in your customer's house style is not going to trip a filter.

So the controls have to move to process, where they always belonged. Verify payment and banking changes out of band — a phone number you already had, not one in the message. Hardware-key MFA, because a convincing prompt beats a push notification. Scope what your own AI assistants can reach, since an inbox agent with broad OAuth is the fastest path from a good lure to real damage. And assume vendor-side moderation catches nothing, because for this class of attacker it catches nothing.

Worth naming the mirror image: Ollama plus RAG is also the stack a small business uses to keep its own data off someone else's cloud. The tooling is neutral. The controls are yours to build.

Sources: Genians Security Center, Al Jazeera, The Hacker News.