Tracking AI Adoption in North Korean Threat Actor Tradecraft
Microsoft, Thursday, October 29th, 2026
Microsoft tracks how North Korean threat actors use AI to speed up and scale existing operations, from front companies to lures.
Microsoft Threat Intelligence says North Korean actors vary in AI adoption but use it as a force multiplier for established workflows rather than changing goals.
Jade Sleet launched campaigns via three front companies in a week, Onyx Sleet generated dozens of tailored lures in minutes, Coral Sleet quickly built a capability to trojanize private source code repositories, and Diamond Sleet used AI for persona development and front company creation.
Onyx Sleet and Pearl Sleet are using the open-source agentic penetration testing framework ARTEX.
The activity serves revenue generation and intelligence collection under sanctions.