Microsoft Threat Intelligence: North Korean hacker groups have integrated AI into their daily attack workflows
Microsoft Threat Intelligence said in a report released on October 29, 2026, that North Korea-linked hacker groups are expanding their use of artificial intelligence to speed up cyberattacks against South Korean users, with the scope extending from customized phishing documents, fake recruiting, and identity spoofing to malicious code development and software supply chain attacks.
The report assessed the AI adoption levels of eight North Korea-linked hacker groups: three groups, including Jade Sleet, Coral Sleet and Jasper Sleet, had reached the highest of the four levels, the “operationalized” stage, integrating AI into their daily attack workflows; four others were in the “accelerating” stage, and one was in the “expanding” stage. From August to September this year, Onyx Sleet customized and generated more than 100 PDF lure documents for different targets. Metadata showed that dozens were produced in batches within minutes, highly likely output from an AI platform, to support high-volume phishing campaigns against South Korean users.
From June 8 to 12 this year, Jade Sleet used three disguised companies, one of which claimed to be an AI-powered blockchain intelligence company, to launch fake recruitment offers at people in the AI, blockchain and cybersecurity fields. Microsoft analyzed that North Korean hackers may use AI coding tools such as Cursor to assist with code generation, debugging and evading detection; since late October, Onyx Sleet, under North Korea’s Reconnaissance General Bureau (which South Korean authorities call Andariel), and Pearl Sleet have been using the open-source AI penetration testing framework ARTEX in real operations. Microsoft believes that although these groups use AI to improve attack speed and efficiency, the activities are still human-led and have not yet entered a fully autonomous attack stage, and it recommends that companies strengthen applicant identity verification, phishing protection and malicious code detection.
Original sources:
Title: Tracking AI adoption in North Korean threat actor tradecraft Publisher: Microsoft Threat Intelligence (Microsoft Security Blog) Publication date: 2026-10-29 URL: https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/ Nature of source: official company threat intelligence report Verification status: This time, the full relevant sections of the report were read, verification date 2026-10-30 Supporting content: assessment of AI adoption stages for eight groups (three operationalized, four accelerating, one expanding), Onyx Sleet’s more than 100 customized PDF lures and minute-level batch generation, Jade Sleet’s June 8-12 fake recruitment through three disguised companies, use of tools such as Cursor to assist code development, Onyx Sleet and Pearl Sleet’s use of ARTEX, the judgment that activities remain human-led, and corporate defense recommendations
Title: AI adoption by North Korean threat actors largely supports existing goals... Publisher: Microsoft Threat Intelligence (official X account) Publication date: 2026-10-29 URL: https://x.com/MsftSecIntel/status/2115837690809626849 Nature of source: official company statement Verification status: The full post was read this time, verification date 2026-10-30 Supporting content: examples of AI acceleration and scaling, including Jade Sleet’s activity through three disguised companies, Onyx Sleet’s minute-level customized lures, and Onyx Sleet and Pearl Sleet’s use of ARTEX
Title: Dozens in Minutes with AI… North Korean Hacking Groups Target South Korea Publisher: SBS News (English edition) Publication date: 2026-10-30 URL: https://news.sbs.co.kr/english/article.do?news_id=N1008823304 Nature of source: media report Verification status: Relevant passages about Microsoft’s report were read this time, verification date 2026-10-30 Supporting content: AI-accelerated attacks targeting South Korean users, more than 100 PDFs, minute-level batch generation, and fake recruitment background
ABAB AI Insight
Microsoft’s report clearly divides North Korean hacker groups’ AI adoption into four stages. Jade Sleet, Coral Sleet and Jasper Sleet have reached the highest, operationalized stage, meaning AI is no longer an experimental tool but is embedded in daily attack workflows from target reconnaissance and lure generation to tool development. From August to September, Onyx Sleet produced more than 100 customized PDF lures targeting South Korean users, and metadata showed minute-level batch generation, directly compressing the time cost of manually producing phishing materials and making high-volume, personalized attacks easier to sustain.
From June 8 to 12, Jade Sleet launched recruitment-themed attacks against people in the AI, blockchain and cybersecurity fields within just a few days through three disguised companies, including one that claimed to be an AI blockchain intelligence company, showing that generative AI is being used to quickly build industry-specific personas, domains and conversation content. This is in line with the long-used North Korean “fake recruitment” tactic (the Contagious Interview type), but AI lowers the customization barrier and makes social engineering against high-value technical talent easier to scale.
Onyx Sleet (which South Korean authorities call Andariel and which is under the Reconnaissance General Bureau) and Pearl Sleet have been using the open-source AI penetration testing framework ARTEX in real operations since late October, while Microsoft observed that some groups may be using coding assistance tools such as Cursor for code generation and evasion. The report emphasizes that these activities are still human-led and have not reached fully autonomous attacks, but AI as an “accelerator” has significantly improved efficiency. For South Korean and global companies, the bar for applicant identity verification, phishing detection and code review is being raised, because the attackers’ customization and iteration speed is now approaching real time.
ABAB News · Cognitive Law
North Korean hacker groups have embedded AI into daily attack workflows, compressing the output speed of customized phishing and fake recruitment from human timescales of weeks to minutes.
Open-source AI penetration testing frameworks such as ARTEX and coding assistance tools such as Cursor are being used for real-world code generation and detection evasion, rather than remaining only in experiments.
AI has increased attack speed and scale, but the activities are still human-led, and companies’ defense priorities remain identity verification and phishing interception rather than purely technical blocking.