Microsoft Identifies AI Use Across Eight North Korean Hacker Groups

Microsoft Threat Intelligence identified AI use by eight North Korean-linked hacking groups, including live deployment of an AI penetration-testing framework and a June campaign targeting people at technology-related organizations.

In its Oct. 29 assessment, Microsoft placed three groups at the operationalized stage, where AI is integrated into routine attack workflows. Four were at an accelerating stage and one at an expanding stage.

Jade Sleet used three front companies posing as recruiters for job-themed targeting from June 8-12, 2026. One presented itself as an AI-powered blockchain intelligence company. Targets included people at organizations involved in AI, blockchain, cybersecurity and talent recruitment.

Onyx Sleet created more than 100 target-specific PDF lure files in August and September 2026. Metadata indicated that dozens were created within minutes at a time, likely using an AI platform.

Microsoft assessed that AI-enabled tools such as Cursor likely helped Jade Sleet, Coral Sleet, Pearl Sleet and Sapphire Sleet generate, convert, debug and refactor code. AI-assisted development cycles can also help threat actors circumvent detection and blocking.

Onyx Sleet and Pearl Sleet have used ARTEX, an open-source AI penetration-testing framework, in live operations since late October 2026. The activity remains human-directed and has not reached fully autonomous operations. Microsoft recommended verifying job candidates’ identities and strengthening phishing defenses and malicious-code detection.