Microsoft says eight North Korean hacking groups now use AI across their operations, still under human direction

Microsoft Threat Intelligence published a report on October 29 that maps how eight North Korean state-linked hacking groups use artificial intelligence. Its overall assessment is that the country's adoption of AI is high, but that the operations "remain human-directed" and have not become fully autonomous.

A four-stage scale

Microsoft sorts the groups by how deeply AI is built into their work. Jade Sleet, Coral Sleet and Jasper Sleet are rated as having operationalised it, meaning AI is part of routine workflows. Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet are described as accelerating, with fast adoption across several functions. Emerald Sleet uses it only for selected activities. No group was placed at the lowest, experimental stage.

The examples are specific. Onyx Sleet produced more than 100 tailored PDF lure files in August and September, dozens at a time within minutes, likely using an AI platform, to support phishing aimed at South Korean users. Coral Sleet has, since April, built a workflow to trojanise private GitHub repositories and feed them into its malware chain, which Microsoft says an AI-enabled development platform likely made possible; the report names Cursor as a likely enabler. Jasper Sleet uses AI-assisted résumé workflows to maintain fake personas that apply for remote jobs. Pearl Sleet and Onyx Sleet have started using ARTEX, an agentic penetration-testing framework. Emerald Sleet may be using AI-generated voice and video, though Microsoft could not determine the full impact.

What has changed, and what has not

Microsoft groups AI use into four areas: reconnaissance, social engineering and identity deception, software development, and scaling operations such as summarising stolen data. It stresses that motives are unchanged: raising money for the regime, collecting intelligence and, in some cases, disruption. Targets include cryptocurrency and financial firms, software supply chains, governments, telecoms, oil and gas, and defence.

The report builds on Microsoft's March analysis, covered by SecureWorld, which focused on Jasper Sleet and Coral Sleet and said agentic AI had not yet been seen at scale.

Recommendations

Microsoft advises organisations to tighten patching and phishing defences, block device-code sign-in flows where possible, and vet remote hires more carefully, for example by checking for duplicate accounts, shared phone numbers and genuine on-camera participation. The report does not say whether Microsoft has taken enforcement action against the accounts involved.