Genians says Kimsuky has moved AI use off public services and onto its own infrastructure, running Ollama, GPT4All, and Msty offline while testing retrieval-augmented generation and collecting libraries that could support phishing, malware development, and data analysis.
The setup matters because the model can work from files the operators already have without sending prompts to a cloud chatbot. That makes it easier to draft lures, sift data, or prototype malware while leaving fewer logs and fewer vendor-side traces, and it also strips away the awkward wording defenders often use as a phishing tell.
For government and education targets, the practical shift is that the weak signal may no longer be the message itself. If Kimsuky can keep AI inside its own environment, the more durable evidence will be in execution and follow-on activity rather than in obviously bad grammar.