Microsoft Threat Intelligence has observed a notable expansion in the adoption of AI technologies by North Korean-linked cyber threat groups, aimed at increasing the speed, efficiency, and complexity of their cyberattacks. These groups are leveraging AI as an operational force multiplier, particularly to accelerate and scale long-standing workflows in phishing and social engineering. However, these operations have not yet reached the stage of full autonomy, as they remain subject to continuous human management and direction.
Microsoft classifies the levels of AI adoption among these groups into several stages, ranging from emerging and expanding to advanced and fully operationalized. Monitoring shows that groups such as Jade Sleet, Coral Sleet, and Jasper Sleet have fully integrated AI into their daily operational processes, which include identity-spoofing attacks and social engineering campaigns precisely targeted at technical and financial objectives.
Stages of Operational AI Deployment
North Korean groups rely on AI technologies across various stages of an attack, from target reconnaissance and information gathering to content generation and malware development. In this context, groups such as Onyx Sleet and Pearl Sleet have been observed employing open-source AI agent frameworks, such as the ARTEX penetration testing framework, to execute their operations, reflecting a rapid response in adopting modern technologies as soon as they become available.
Furthermore, these groups use AI-powered development tools like the Cursor platform to generate, convert, debug, and refactor malicious code. This has enabled some groups to accelerate software development and bypass blocking and defense measures imposed by modern security systems by rapidly adapting to detection mechanisms.
What is Practically Changing in the Nature of Attacks?
The most significant shift identified by the report is the ability of these actors to scale disruptive operations and lure victims at unprecedented rates. Notable tactics include:
- Accelerating preliminary reconnaissance on targeted organizations and extracting detailed information about employees to craft highly persuasive, customized phishing and intrusion messages.
- Generating dozens of PDF files and targeted guides within minutes using automated generation tools to launch intensive phishing campaigns.
- Building comprehensive fake digital identities and resumes to support infiltration and remote work operations at technology companies and financial institutions to secure financial returns that serve the North Korean regime.
- Developing malware capabilities, such as employing dynamic compilation techniques for .NET code to evade security detection.
Protection and Countermeasures
In the face of these evolving threats, Microsoft has called on organizations to strengthen their cyber defense strategies by activating built-in protection tools such as the Security Dashboard for AI and the Agent 365 management platform. This is in addition to implementing vulnerability management policies, enabling automated monitoring in endpoint protection suites, and enforcing strict verification procedures when hiring applicants to carefully assess their technical and digital backgrounds to prevent infiltration through intermediary companies.