Reported by 2 outlets

Timeline

1. update from cyberpress.org

   Kimsuky Moves AI-Assisted Development Into Local Environment With Operation GitPower

   cyberpress.org · 56d ago · August 18th, 2026

   North Korean threat actor Kimsuky has expanded its cyber espionage toolkit with local artificial intelligence tools as part of a campaign researchers call Operation GitPower. The activity combines the group’s familiar spear-phishing methods, malicious Windows shortcut files, PowerShell loaders, and GitHub-based command-and-control infrastructure with a growing AI development environment. Researchers at Genians Security Center found signs that Kimsuky is not simply testing public generative AI services. Instead, the group appears to be building local systems that can run large language models, process private documents, support code development, and convert speech to text without sending data to external providers. The campaign shows how established threat actors may use AI to improve operational speed while keeping their core intrusion methods unchanged. Kimsuky still relies on targeted social engineering and cloud-hosted infrastructure, but AI could help it create better lures, modify malware faster, and process stolen intelligence more efficiently. Kimsuky Launches Operation GitPower Operation GitPower begins with targeted spear-phishing emails carrying ZIP archives . These archives contain malicious LNK files disguised as legitimate documents. The lures use themes linked to government agencies, embassies, research, finance, legal agreements, and international events. When a victim opens the shortcut file, it launches an obfuscated PowerShell command. At the same time, a de

2. update from gbhackers.com

   Kimsuky Uses Local AI Development Environment to Expand Cyber Espionage Tooling in Operation GitPower

   gbhackers.com · 56d ago · August 18th, 2026

   North Korean state-backed threat actor Kimsuky is extending its established espionage playbook with locally hosted artificial intelligence tooling, according to new research into an activity cluster tracked as Operation GitPower. The campaign retains familiar phishing-led intrusion chains but shows the operators preparing AI-assisted capabilities for malware development, data analysis, social engineering, and operational automation. The […] The post Kimsuky Uses Local AI Development Environment to Expand Cyber Espionage Tooling in Operation GitPower appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .