A South Korean cybersecurity firm reported that the North Korea-linked hacking group Kimsoo-ki developed custom tools to run large language models locally—including Ollama, GPT-4-All, and Mistral—and uses retrieval-augmented generation to automate cyberattacks and analyze stolen data. The firm Genians identified evidence that the group built capabilities to run and manage AI models locally, allowing operators to process documents without transmitting sensitive information to external AI services. According to Genians, Kimsoo-ki has moved beyond using generative AI for crafting phishing tools and is now building capabilities to integrate existing AI models into malware development, data analysis, and attack automation. Independent verification of the findings has not been possible. U.S. and South Korean authorities assert that North Korea has deployed state-linked cyber units for years to conduct espionage, theft, and financial gain. The U.S. Department of the Treasury imposed sanctions on Kimsoo-ki in 2023, designating it as a North Korean government–affiliated cyber espionage group.