North Korean government snoops are operating LLMs locally and collecting technology to weave AI into their attack operations, according to South Korean security firm Genians.

The researchers said they observed Kimsuky setting up and operating local LLM environments using Ollama, GPT4All, and Msty, experimenting with other AI tools such as Cursor, and using retrieval-augmented generation (RAG) for local document searches. This prevents the data from getting sucked into the cloud where enemies might see it and try to stop it.

Kimsuky, a cyber-espionage crew that operates under North Korea’s Reconnaissance General Bureau, has for years used phishing and decoy documents in attacks targeting government agencies, think tanks, academia and security research organizations. 

Genians’ findings “provide concrete evidence that the Kimsuky-affiliated threat actor is moving beyond one-off experimentation with AI and is continuously preparing to integrate the technology into actual attack capabilities, including malware development, data analysis, and the advancement of attack techniques,” the researchers said in a Monday report.

The North Korean group’s recent phishing emails use ZIP archives containing malicious LNK files – Kimsuky typically disguises these as materials related to international events, research reports, or meeting requests. When the recipient opens the archive and executes the LNK file contained within it, the shortcut runs an embedded PowerShell loader.

In some cases, the goon squad used AI to create lures related to virtual assets and finance, we’re told. These decoy documents “use natural language, a highly polished structure, and formats similar to actual business materials to increase user trust and induce the execution of malicious files,” the security analysts noted.

Additionally, the Pyongyang spies use various obfuscation techniques, including Base64 encoding, string splitting, and custom decoding routines, to hide the files’ malicious behavior.

The PowerShell script collects a ton of system information, including operating system version and architecture, system configuration, PC type, operating system installation and boot history, and a list of running processes. The attackers use this information to assess the infected environment and support follow-on attacks.

As with earlier Kimsuky campaigns, these intrusions use Git repositories for command-and-control (C2) infrastructure.

“During the analysis, Genians Security Center identified multiple public GitHub repositories operated by the threat actor,” the researchers wrote. “One repository contained not only configuration files and PowerShell scripts, but also various payloads used in subsequent attacks.”

Additionally, the months-long investigation uncovered the spies also using the Git-based C2 infrastructure for malware development and testing, stolen data management, and AI technology research.

This included setting up multiple local LLM environments using Ollama, GPT4All, and Msty on infrastructure it controlled. “Because the local approach prevents conversation data from being transmitted to external AI services, it reduces the risk of external exposure, making it a particularly attractive option for a state-sponsored threat actor,” Genians said.

The miscreants also collected a “large number” of libraries, such as LLaMaSharp and Microsoft.Extensions.AI, plus packages including OpenAI and Azure.AI.OpenAI, which call and integrate commercial AI services into their own custom applications.

“The fact that development components spanning ‘local AI execution → document retrieval (RAG) → automated agents → external AI integration’ were collected together strongly suggests that they were not gathered out of simple curiosity, but for the direct development of an AI-based tool designed for a specific purpose,” according to the threat hunters.

Genians uncovered logs containing speech-to-text tools, such as OpenAI’s Whisper speech recognition models, and evidence that the spies used Cursor AI to edit code and tested RAG for document-based question answering. Using RAG on stolen files can help attackers more quickly and automatically identify valuable information within large volumes of data.

While the researchers noted that they did not identify any evidence that the Norks have begun training their own models – but rather remain focused on applying AI to malware development and attack operations – the findings make a strong case for defenders needing to shift away from content-based assessment to behavior-based detection.

Assessing threats based on the quality of fake documents, such as unnatural translated language, poor formatting, and spelling errors, is no longer effective because AI is really good at producing convincing decoys.

In addition to using indicators of compromise (IoC) to detect attackers in their environments, organizations should look for anomalous behaviors following LNK execution – such as PowerShell execution, persistence establishment, and external communications – to hunt for threats.®

from the setting-money-on-fire dept

When SpaceX filed for its IPO, we went through the S-1 to point out just how far off the mark Elon Musk’s predictions about his Twitter takeover turned out to be. Indeed, the failure of Twitter as a business was so catastrophic, Musk had to hide it by merging all his Xs together: he had xAI buy X (formerly Twitter), and then had SpaceX buy xAI. But when Musk was buying Twitter and needed investors, he made bold promises about how he would succeed — promises the media and his investors treated as perfectly reasonable. He said he would take Twitter’s ad revenue from $4.5 billion in 2021 to $12 billion in 2027 (and then also many more billions in subscription revenue).

Now that SpaceX is a public company, he has to report some of that revenue, though it’s all merged and buried in footnotes. But there’s enough info in there to show that advertising revenue is way, way below what it was when he took over the site. And it’s shrinking.

In the 10-Q, all of X’s revenue is now (misleadingly) labeled “AI” revenue, but even then the reporting has to admit ad revenue took a big hit, dropping $160 million compared to the first half of 2025 (which was already way, way, way lower than when Elon took over the site), going from $870 million in 2025 to $710 million in the first half of 2026. The company tries to claim that this decrease in ad revenue is because they “transitioned to a new advertising platform which impacted ad sales for a short period of time.” Which is a curious explanation, given that on the analyst call, CFO Bret Johnsen credited that very same “overhauled” ad-tech platform for the very slight quarter-over-quarter uptick in ad revenue. The same overhaul apparently both tanked the business and rescued it, depending on which direction the number was moving.

And even the claim that the overhaul increased ad revenue is suspicious given that if you compare the 2nd quarter from last year to this year… ad revenue dropped from $426 million to $367 million, year over year. Some overhaul.

I kinda think that if your transition to a new ad platform decreases ad sales by $160 million, someone fucked up badly somewhere. Especially when it’s a nearly 20% year-over-year drop.

Let’s break all this down: In the second quarter of 2022, the last full quarter before Elon took over, Twitter brought in $1.08 billion in ad revenue. In the second quarter of 2026, X brought in $367 million. That’s $713 million a quarter, gone. Elon has wiped out two-thirds of Twitter’s ad business over the exact period in which he promised investors he’d nearly triple it.

And it’s not for lack of trying. Over the past year X has made a ton of experiments and revamps to improve the experience (though the main person in charge of all that, just left). I’d argue that the company was just rebuilding all of the stuff Elon killed after first taking over the company, but none of it has brought advertisers back.

Turns out that telling advertisers to go fuck themselves… and then suing other advertisers for not advertising… doesn’t make anyone want to advertise with you.

Still, it seems like someone should be pointing out how far off the mark Elon has been. He promised twelve billion dollars in ad revenue within the next year. That’s three billion a quarter. X just did $367 million — about an eighth of the pace, and shrinking. You can talk all you want about his rockets and robots, he’s not magically going to grow ad revenue 700% in the next 18 months.

So, tell me again how Elon is a business genius?

Filed Under: advertising revenue, elon musk, revenue

Companies: spacex, twitter, x, xai

OpenAI has bought back $7 billion worth of shares from employees at the privately held frontier AI lab as part of an effort to provide liquidity to its workforce.

The deal, reported by Bloomberg, valued OpenAI at $852 billion, the same as its most recent fundraising round in March, which added $122 billion to the company’s war chest.

The company also filed confidentially with the Securities and Exchange Commission in June to prepare for a potential IPO later this year. However, a tender offer suggests that an IPO may not be forthcoming soon. With many tech companies remaining private longer than previous generations of startups, private tenders have proven a useful way for firms to allow employees to realize the value of their stock compensation without the difficulties that come with a public offering.

OpenAI did not respond to a request for comment by publication time.

Last month, OpenAI CEO Sam Altman wrote that “we did not have our best 12 months ever, which is mostly my fault, but we are about to have our best 12 months to date.” Firms going public typically want to show strong financial results to bring investors on board, and the Wall Street Journal reported in April that the company missed internal financial goals.

While OpenAI’s incredible growth and products are likely to generate massive interest in public markets, the potential debut of rival Anthropic — which was reportedly profitable earlier this year — gives the company a reason to ensure it puts its best face forward. The tender could be another signal that the much-anticipated offering will wait for OpenAI’s new strategy of paring down its bets and focusing on its enterprise business to gain traction.

Reference Image could be a new way to prove provenance in the wake of generative AI.

Heading back to college in 2026 means bringing a lot more than a laptop, phone and whatever survived last semester at the bottom of your backpack. The best back to school tech for college students needs to solve real problems: keeping devices charged through a long day on campus, blocking out a roommate who believes 2 a.m. is an appropriate time for FaceTime, making a cramped dorm room more functional, and helping you study, stream, listen and stay connected without spending the semester’s food budget before classes even begin.

That’s the problem with most back to school tech guides. They’re stuffed with products because somebody has to fill the shopping cart. We’ve taken a different approach. Our 2026 college tech essentials focus on products we think students will actually use, from headphones, wireless speakers and chargers to computer accessories, portable gear and dorm room upgrades that can make campus life easier. Some are inexpensive. Others are worth spending more on because they should survive well beyond freshman year.

Audioengine D1P

Give your college student better sound for the school year. The D1P connects to their laptop and makes even cheap headphones sound world-class, bringing out cleaner sound and deeper bass, allowing them to hear their music the way the artist intended. Compact enough for a dorm desk or backpack, it’s an easy upgrade for studying, gaming, or listening between classes.

$169 at Audioengine

Advertisement

Audio-Technica ATH-M50xBT2 Wireless Headphones

The ATH-M50xBT2 combines Audio-Technica’s acclaimed studio sound with wireless convenience. Enjoy up to 50 hours of battery life, multipoint pairing, and low-latency mode. Customize your sound with the A-T Connect app or plug in using the included cable. A smart back-to-school upgrade for students without compromising performance.

$179 at Audio-Technica

IsoAcoustics ISO-Stand

Upgrade any dorm, bedroom, or study setup with the IsoAcoustics ISO-Stand Series. With 14 height and tilt configurations, ISO-Stands help position bookshelf speakers at the ideal listening angle while reducing unwanted vibrations for cleaner sound, improved clarity, and better focus at the desk.

$115-$195/pair at Amazon

Polk Audio Signature Elite ES15

Ideal for small spaces, the Polk Audio Signature Elite ES15 compact bookshelf speakers offer an audiophile upgrade without breaking the bank. Connect to any amp or receiver you already have, or combine with Denon Home Amp (below) for a powerful 200-watt speaker system that doesn’t take up much space.

$299/pair at Amazon

Advertisement

Denon Home Amp

The Denon Home Amp is a compact, yet versatile box that combines a 100-watt x 2 amplifier, built-in wireless music streaming with Bluetooth and multi-room HEOS, plus HDMI eARC to seamlessly connect with any TV. And there’s an option to add a subwoofer. Just connect to any speakers.

$899 at Amazon

Samsung Smart Monitor

Samsung’s top-of-the-line 32-inch Smart Monitor M90SF is a triple threat on your desktop, offering pixel-perfect QD-OLED 4K technology for watching movies or TV shows, playing games, or handling schoolwork. Plus its glare-free screen means it will be easier on your eyes in any lighting condition.

$1,599 $1,199 at Amazon | Best Buy

Anker Nano 10-in-1 Power Strip

Anker’s 10-in-1 power strip ensures roommates never need to ask where the charger is. Access 2 x USB-C ports, 2 x USB-A ports, and 6 x AC outlets, right from your desktop.

Advertisement

$69.99 at Amazon

Need more gift giving ideas?

Disclosure: The products listed above are approved by our Editors, but may be requested by our sponsors. When links to buy are provided, we’ll direct you to the lowest price at time of publication. In doing so, eCoustics may earn a small commission from the associated retailer if purchased.

You’ve seen fiber-reinforced-plastic before, no doubt, but perhaps never quite like in this video by [Whitburn Studio]: it’s still got the usual resin, but instead of glass or carbon fibers, he’s using printed Japanese cotton to create strong, lightweight and good looking parts for the interior of his RV– specifically the countertops.

The technique is very similar to the sort of moldless composite work Burt Rutan pioneered in aircraft use. The fiber-reinforced plastic is formed around a positive ‘buck’ that remains inside the final part, adding stiffness and some backing. Unlike Rutan’s designs, which used pure Styrofoam inside, [Whitburn] is using a sandwhich of two layers of thin ply (3.6 mm) with XPS foam in between. Adding plywood means you don’t need many layers of fiber– again, that’s a decorative cotton, here– to get a surface that won’t dent into the styrofoam when you drop a coffee cup on it.

Indeed, with the plywood providing much of the strength, he’s only using a single layer of cotton and a second of fiberglass– though the glass fibers are really there to protect the pretty print from oopsies while sanding, rather than for their mechanical properties, by the sounds of it. Everything is held together with clear epoxy resin, which also fills the weave of the fabrics. Multiple coats of that are required to get the smooth, shiny surface he shows off at the end, but all that sanding and buffing really pays off. That’s also where you have to be really careful to avoid oopsies– go through the cotton and you have to start over.

Aside from the aesthetics, since this is going in a vehicle the weight is an important consideration– the bigger of the two counters he makes, pictured here, weighs in at only 2.4 kg or 5.2 lb including the cutout covering the sink. That’s pretty good all things considered– a lot lighter than a cement countertop, or even one made of DIY resin tiles.