Microsoft Finds Broad AI Use Among North Korean Threat Groups

Microsoft says North Korean threat actors are using generative and agentic AI across reconnaissance, social engineering, malware development and operational tasks, in an October 29 blog post. Its threat intelligence team rates overall AI adoption among the groups as high, but says their operations remain directed by humans rather than fully autonomous.

Microsoft classifies Jade Sleet, Coral Sleet and Jasper Sleet as having integrated AI throughout routine operations. It places Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet in an accelerating stage, while Emerald Sleet is expanding its use of the technology.

The company identified more than 100 PDF lures created by Onyx Sleet during August and September 2026, with dozens generated within minutes and tailored to specific targets. It also linked AI tools to fake worker personas, job themed outreach, software development and the compromise of private GitHub repositories.

Since late October, Microsoft has observed Onyx Sleet and Pearl Sleet using ARTEX, an open source agentic penetration testing framework. The groups use AI mainly to increase the speed and scale of established methods, including phishing, identity deception and malware delivery.