South Korean cybersecurity firm Genians reported on the 10th that it secured evidence North Korea's hacking group Kimsuky, operating under the Reconnaissance General Bureau, has built local large language model (LLM) execution environments to integrate generative AI into cyberattacks, including spear-phishing campaigns. Genians named the campaign "Operation GitPower," stating Kimsuky repurposed GitHub and GitLab-based command-and-control (C2) infrastructure as an AI research environment. Traces of three local LLM tools—Ollama, GPT4All, and Msty—were found installed on Kimsuky's C2 servers, along with evidence of Retrieval-Augmented Generation (RAG) configurations, AI agent development libraries, and files related to OpenAI's speech-to-text model "Whisper." Genians assessed there is not yet sufficient evidence of direct AI model training, describing it as "a phase of researching and learning how to integrate existing AI into attack activities." Records also showed installation of "Cursor," an AI-powered code editor, used to edit attack documents and review outputs, indicating research into AI for malware development and attack automation. Attribution evidence included Korean Dubeolsik keyboard sentences containing North Korean vocabulary like "ssaiteu" (site) and "riryeok" (resume), plus the system manufacturer name "Arirang." A defining characteristic is significantly improved bait document quality, now mass-produced and virtually indistinguishable from genuine business materials.