Genians links Operation GitPower to Kimsuky, which uses spearphishing, malicious LNK files, obfuscated PowerShell, scheduled tasks, and Git repositories to collect system data and deploy encrypted AsyncRAT payloads. Infrastructure logs show the operators installed and used Ollama, GPT4All, and Msty, configured document-based RAG, and collected C#/.NET libraries for AI agents, external AI integration, and speech-to-text processing. The evidence indicates capability-building around existing models rather than proprietary model training, with likely applications in malware development, stolen-data analysis, and social-engineering automation. Linguistic artifacts, earlier campaign overlap, and infrastructure behavior support the North Korean and Kimsuky attribution.