North Korean Threat Actors Accelerate Cyber Operations With Artificial Intelligence
Do Son 
At a Glance
| Actor or Group | North Korean state-sponsored threat actors (Jade Sleet, Onyx Sleet, Coral Sleet, Diamond Sleet, Pearl Sleet, Jasper Sleet, Sapphire Sleet, Emerald Sleet) |
| Activity Type | AI-assisted reconnaissance, social engineering, IT worker fraud, supply chain compromise, and ARTEX agentic pentesting |
| Targets or Victims | Cryptocurrency, financial institutions, defense, energy, education, IT, and software supply chains |
| Scale | Hundreds of rapid PDF lures, 3 front companies launched in a single week, and global cryptocurrency thefts |
| Jurisdiction / Law Enforcement Status | Democratic People’s Republic of Korea (DPRK); subject to UN and US sanctions; multiple FBI and DOJ indictments for related state-sponsored cybercrime |
TL;DR
Microsoft revealed that North Korean threat actors are adopting artificial intelligence to accelerate cyber operations. Specifically, groups like Onyx Sleet and Pearl Sleet use the open-source ARTEX framework and automated development environments to scale attacks. Furthermore, AI-enabled North Korean threat actors deploy fake job personas, generate hundreds of lures in minutes, and trojanize private software repositories.
What Happened
In October 2026, Microsoft documented how North Korean state-sponsored hacking groups integrate generative models into their daily attack chains. According to the Microsoft Threat Intelligence report, “Threat actors use AI as a force multiplier across their operations, particularly to accelerate and scale established workflows.” For instance, Jade Sleet created three fraudulent front companies in just one week to deceive tech workers. At the same time, Onyx Sleet produced dozens of tailored PDF lures in minutes to target South Korean users. Regarding this volume, Microsoft stated that “Metadata indicated that the actor created dozens of files at a time in rapid succession within minutes, highly likely to be the output of an AI platform.” Meanwhile, Coral Sleet built an automated pipeline to trojanize private GitHub repositories. Additionally, Diamond Sleet returned to targeting the oil and gas sector while setting up fake communications firms.
Tooling Development and Agentic AI Frameworks
North Korean threat actors also rely on coding assistants like Cursor to write, debug, and translate malicious code. During an August 2026 intrusion targeting Rust developers, Sapphire Sleet added dynamic runtime compilation to evade security software. Most notably, Onyx Sleet and Pearl Sleet adopted the open-source ARTEX penetration testing framework. This framework breaks intrusion objectives into automated tasks executed by autonomous software agents. Consequently, operators can conduct rapid network reconnaissance and vulnerability probing with minimal manual oversight.
Who Is Behind It
Microsoft attributes these activities to state-sponsored hacking clusters operating under the direction of North Korean intelligence agencies. Attribution confidence is high based on long-term tracking of shared command infrastructure, victimology, and operational patterns. Furthermore, Microsoft categorizes these actors across four stages of technical maturity: operationalized, accelerating, expanding, and emerging. Teams such as Jade Sleet, Coral Sleet, and Jasper Sleet have fully operationalized generative models across their regular workflows. Meanwhile, Diamond Sleet, Onyx Sleet, Pearl Sleet, and Sapphire Sleet remain in the accelerating phase. Emerald Sleet occupies the expanding tier and experiments with synthetic voice and video generation to support social engineering. Crucially, human operators still make the final tactical decisions. As researchers observed, “Despite threat actors’ adoption of AI, Microsoft Threat Intelligence assesses that AI-enabled operations remain human-directed and have not become fully autonomous.”
Impact and Scale
North Korea operates under heavy international trade sanctions and relies on cyber operations to generate illicit revenue for state programs. The scale of these operations extends across cryptocurrency platforms, defense contractors, educational bodies, and energy networks. For example, Jasper Sleet uses synthetic resumes and AI interview aids to help fraudulent IT workers secure remote corporate jobs. These workers then channel their salaries back to Pyongyang while seeking internal access to employer networks. Similarly, cryptocurrency thefts attributed to North Korean units have siphoned billions of dollars from decentralized finance protocols over recent years. By using automated writing tools, AI-enabled North Korean threat actors can quickly translate phishing messages into natural foreign languages. This capability eliminates common spelling errors that previously helped defenders identify foreign spear-phishing messages.
What Comes Next and How to Stay Protected
Security teams must recognize that AI accelerates attacker timelines without fundamentally changing their underlying intrusion techniques. Because attackers still rely on social engineering and credential theft, organizations must enforce phishing-resistant multi-factor authentication across all external services. Furthermore, hiring managers should conduct strict identity verification during remote recruitment to spot synthetic worker personas. Defenders should also monitor developer workstations for unapproved AI extensions and unauthorized access to code repositories. Security operations centers must inspect network traffic for anomalous ARTEX agent activity and unusual outbound connections to unfamiliar cloud endpoints. Finally, enterprises should implement strict software bill of materials checks to prevent trojanized open-source dependencies from reaching production software pipelines.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
