North Korean state-sponsored hackers are turning to artificial intelligence to boost the speed, efficiency and scale of their operations (Microsoft Security Blog). Microsoft Threat Intelligence saw several groups weave generative and agentic AI platforms into campaigns that support state goals and generate revenue despite sanctions.
AI use cuts across distinct North Korean units, each with its own tactics. Jade Sleet rolled out three front companies in a single week, while Onyx Sleet churned out dozens of custom lures within minutes. Coral Sleet added the ability to trojanize private source‑code repositories, and Diamond Sleet used AI to sharpen targeting, including persona development.
Open‑source AI security tools are also finding a home in offensive work. Onyx Sleet and Pearl Sleet both employ the agentic AI penetration‑testing framework ARTEX for operations. Microsoft notes this shows a willingness to fold emerging AI software into existing workflows quickly.
Microsoft Threat Intelligence judges that, despite these capabilities, AI‑enabled attacks remain directed by humans. The technology amplifies existing objectives rather than reshaping motivations or enabling fully autonomous strikes.
Core tradecraft still hinges on social engineering, malware delivery and the abuse of legitimate tools. Campaigns repeatedly hit software supply chains, IT firms, financial services, cryptocurrency platforms, government bodies and educational institutions.
Microsoft rates overall AI adoption among North Korean threat groups as high. While Jade Sleet, Coral Sleet and Jasper Sleet demonstrate AI use across their workflows, adoption continues to spread throughout the broader threat landscape.
The rapid deployment of open-source agentic frameworks like ARTEX by state-backed groups suggests that the boundary between offensive security research and malicious exploitation is blurring faster than anticipated. As threat actors integrate low-cost AI automation to handle initial reconnaissance and lure generation, defenders will likely face a severe volume issue. Security teams must transition toward automated detection systems, as manual response times will prove insufficient against AI-accelerated targeting pipelines.
Spotted an error? See our corrections policy or email editorial@lordofclaude.com.
Discussion & Comments (0)
Join the conversation