CriticalRansomware
Tracking AI adoption in North Korean threat actor tradecraft
Microsoft Security·Source published ·1 min read
What happened?
In this article Stages of AI adoption by North Korean threat actors AI use across North Korean threat operations AI-assisted targeting and reconnaissance AI-assisted social engineering and identity deception AI-assisted software and tooling development AI-assisted operational scaling and analysis Mitigation and protection guidance Microsoft Defender detections As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed, efficiency, and complexity of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying leve…
Key details
- North Korean threat actors use AI as a force multiplier to accelerate and scale existing cyber operations.
- Jade Sleet launched campaigns through three front companies in one week using AI-accelerated workflows.
- Onyx Sleet generated dozens of tailored phishing lures in minutes, likely using an AI platform.
- Coral Sleet rapidly built a new capability to trojanize private GitHub repositories, likely using AI-enabled development platforms.
- Diamond Sleet uses AI to enhance tailored targeting workflows including persona development and front company creation.
- Onyx Sleet and Pearl Sleet leverage the open-source agentic AI penetration testing framework ARTEX for operations.
- Microsoft assesses overall AI adoption by North Korean threat actors as high, with Jade Sleet, Coral Sleet, and Jasper Sleet operationalizing AI across all workflows.
Affected
- Cryptocurrency and financial organizations are commonly targeted.
- Information technology companies and software supply chains are commonly targeted.
- Education-related organizations are commonly targeted.
Fixes and mitigations
- Mitigation guidance and Microsoft Defender detections are provided to help organizations defend against these threats.
What to look for
- Over 100 PDF lure files created by Onyx Sleet in August and September 2026 with target-specific details.
- Metadata shows Onyx Sleet created dozens of lure files at a time in rapid succession within minutes.
- Possible synthetic media generation including AI-created voice and video by Emerald Sleet.
- Use of AI-assisted development platforms such as Cursor by Jade Sleet, Coral Sleet, Pearl Sleet, and Sapphire Sleet.
- Onyx Sleet and Pearl Sleet leveraging the open-source agentic AI penetration testing framework ARTEX.
Summarised by SecOraLens from Microsoft Security. Always read the original source before acting. How SecOraLens verifies advisories.