Microsoft: North Korean Hacking Groups Have Built AI Into Routine Operations, Three of Them at Full Scale

North Korean hackers have stopped treating AI as an experiment. A Microsoft Threat Intelligence report from October 29 says some groups have folded it into everyday processes, and two more have used the open-source tool ARTEX in operations since late October.

Four stages of adoption

Microsoft places the most dangerous North Korean groups into four maturity stages: emerging, expanding, accelerating and operationalized. The last category includes Jade Sleet, Coral Sleet and Jasper Sleet, where AI is embedded in routine processes across the whole operation.

In the accelerating stage the company lists Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet. Emerald Sleet is at the expanding stage, because AI shows up in some of its workflows but its impact is smaller than that of the others. Microsoft did not assign any group to the emerging stage.

ARTEX and lures in minutes

ARTEX is an open-source, agentic framework for penetration testing. According to Microsoft, Onyx Sleet and Pearl Sleet have used it in operations since late October 2026, which the company reads as a sign that these groups quickly adopt new AI technologies. The report gives no technical details about the tool itself.

More than 100 PDF lure files with target-specific details, created in August and September 2026, were attributed to Onyx Sleet. Metadata showed that dozens of files were produced within minutes, which Microsoft says is highly likely the output of an AI platform. The lures were used in high-volume phishing against users in South Korea.

Code, front companies and fake workers

Microsoft says AI-assisted development platforms, including Cursor, have likely helped Jade Sleet, Coral Sleet, Pearl Sleet and Sapphire Sleet. The uses include generating, converting, debugging and refactoring code, as well as scripts, persistence mechanisms and obfuscation. According to the report, this also speeds up retooling after defenders block something.

Between June 8 and June 12, 2026, Jade Sleet ran recruitment campaigns through three front companies. The first posed as an AI-powered blockchain intelligence firm, and the other two followed. Diamond Sleet built fictitious telecommunications companies with websites and personas to target telecom operators.

Jasper Sleet uses fake identities to land remote jobs, and AI helps it write resumes, maintain personas and keep communication consistent across multiple fraudulent workers. The report does not say how many such workers there are.

Caveats and recommendations

Microsoft stresses that AI-enabled operations remain human-directed and have not become fully autonomous. AI mainly speeds up existing techniques and boosts operator productivity, and it does not change the groups' goals. Some attributions are cautious: the report uses the terms "likely" and "highly likely", for example on Sapphire Sleet's probable use of AI in the August compromise of Rust ecosystem software and on Coral Sleet trojanizing GitHub repositories.

Microsoft recommends, among other things, vulnerability management and isolating internet-facing systems, phishing training, malware protection (EDR in block mode) and careful vetting of job candidates: duplicate profiles and phone numbers, interviews with the camera on, and checks of the digital footprint. For Polish companies that hire remotely, the last point has practical weight, since the report describes people winning remote jobs under fake identities. The candidate-vetting advice itself is general.