Tracking AI adoption in North Korean threat actor tradecraft

This is a Microsoft Threat Intelligence briefing on how North Korean threat actors are adopting AI across their operations. The core finding: AI is being used as a force multiplier to accelerate and scale established workflows, not to change actor motivations.

Key takeaways

• Jade Sleet, Coral Sleet, and Jasper Sleet are assessed as having operationalized AI across their entire operations.
• Diamond Sleet, Onyx Sleet, Pearl Sleet, and Sapphire Sleet are at the accelerating stage.
• Onyx Sleet and Pearl Sleet are leveraging the open-source agentic AI penetration testing framework ARTEX.
• AI-enabled operations remain human-directed and have not become fully autonomous.

Practical examples

• Jade Sleet launched campaigns through three front companies in a single week.
• Onyx Sleet generated dozens of tailored lures in minutes.
• Coral Sleet rapidly built a new capability to trojanize private source code repositories.
• Diamond Sleet used AI to enhance tailored targeting workflows, including persona development and front company creation.

News · Microsoft Security Blog · Publisher website: microsoft.com · Last verified 31 October 2026 · Catalog ID 127986