According to CoinMeta, North Korean hacker group Kimsuky has established three local AI environments in preparation for cyberattacks on cryptocurrency and financial companies. South Korean cybersecurity firm Genians pointed out in a report released on Monday that Kimsuky operates large-scale language model environments through Ollama, GPT4All, and Msty, allowing them to use AI tools without relying on external cloud services. The research also found that these environments support enhanced generation, enabling the connection of AI models with additional information provided by operators. Kimsuky also collected AI coding assistants, Cursor, and voice-to-text tools to build its AI infrastructure. This activity does not indicate that the group is developing proprietary AI models; instead, it applies existing open-source technologies to malicious software development, data analysis, and attack automation. Genains assessed that this activity has gone beyond isolated testing, and Kimsuky is continuing to prepare to incorporate AI into its operational attack capabilities.