North Korean actors use AI to scale social engineering and malware
Original title: Tracking AI adoption in North Korean threat actor tradecraft
Microsoft rates Jade Sleet, Coral Sleet, and Jasper Sleet as operationalized; operations remain human-directed, not autonomous.
Microsoft Threat Intelligence says North Korean threat actors are using generative and agentic AI to speed existing revenue, espionage, and disruption work rather than to run attacks autonomously. Named groups apply AI to reconnaissance, lures, personas, front companies, and tooling, including trojanizing private source-code repositories. Onyx Sleet and Pearl Sleet are using the open-source ARTEX penetration-testing framework. The post maps adoption from expanding to operationalized and says Defender detections and mitigations are included.
Unconfirmed: Adoption stages and the claim that operations stay human-directed are Microsoft assessments; the excerpt ends during reconnaissance.
- Jade Sleet ran campaigns through three front companies in one week.
- Onyx Sleet produced dozens of tailored lures in minutes.
- Coral Sleet built a way to trojanize private source-code repositories.
- Targets include crypto, finance, IT supply chains, government, and education.
- Emerald Sleet is rated expanding; no actor is only emerging.
Impact: Speeds social engineering, malware delivery, and supply-chain intrusion
- Products
- Microsoft Defender
- Threat actors
- Jade SleetOnyx SleetCoral SleetDiamond SleetPearl SleetJasper SleetSapphire SleetEmerald Sleet
- Malware
- ARTEX
- Organizations
- Microsoft
- Countries
- North Korea
From the original article
12 min read at microsoft.com
As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying levels of adoption.
By Microsoft Threat Intelligence · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.