North Korea’s hackers and fake IT workers now lean on AI at every step, Microsoft says

Microsoft Threat Intelligence reported on Thursday that North Korea's state hacking groups have made AI a routine part of their operations, rating the country's overall adoption as "high" and placing three groups — Jade Sleet, Coral Sleet and Jasper Sleet — at the most advanced of its four stages, "operationalized." Microsoft said Onyx Sleet produced more than 100 target-specific PDF lure files in August and September, with metadata showing dozens created within minutes of each other and "highly likely to be the output of an AI platform," while Jade Sleet posed as recruiters for a spoofed "AI-powered blockchain intelligence company" between June 8 and June 12 and Jasper Sleet used suspected AI-assisted resume workflows to run fake remote IT workers. Microsoft also said AI coding platforms "such as Cursor" likely helped Jade Sleet, Coral Sleet, Pearl Sleet and Sapphire Sleet write, convert and debug code and rebuild tools after defenders blocked them, with Sapphire Sleet likely using AI in an August 2026 compromise aimed at Rust developers.

North Korean leader Kim Jong Un centre with members of his delegation at talks in Vladivostok, Russia, in April 2019 illustrative . Image: The Presidential Press and Information Office Kremlin.ru <https://commons.wikimedia.org/wiki/File:Kim Jong-un 2019-04-25 02.jpg / Wikimedia Commons, CC BY 4.0 https://creativecommons.org/licenses/by/4.0/ , cropped North Korea’s state hackers have made AI a routine part of their work, using it to build fake job applicants, churn out phishing lures by the dozen and help write malware, Microsoft Threat Intelligence said on Thursday https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/ . It rates the country’s overall adoption of AI as “high” and says three of its hacking groups now use it across their entire operations. Microsoft tracks North Korean groups under “Sleet” code names. It puts Jade Sleet, Coral Sleet and Jasper Sleet at the most advanced of four stages, which it calls “operationalized”; Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet at “accelerating”; and Emerald Sleet at “expanding”. No group is left at the bottom, “emerging” stage. The goals haven’t changed, Microsoft says: raising money for a heavily sanctioned regime, gathering intelligence and sometimes disruption, with crypto and financial firms, IT companies and software suppliers, governments and education among the usual targets. These are Microsoft’s own assessments, drawn from its threat tracking and from industry reporting. Fake recruiters and fake workers Much of the activity revolves around jobs. Between June 8 and June 12, Microsoft says, Jade Sleet posed as recruiters for a spoofed “AI-powered blockchain intelligence company”, approaching people in cybersecurity, AI, blockchain and recruitment with software engineering roles and booking interviews with anyone who replied. In the same few days it ran similar campaigns through two more front companies. Microsoft says that pace shows generative AI at work. Jasper Sleet works the other side of hiring: it is the group behind North Korea’s fake remote IT workers https://www.microsoft.com/en-us/security/blog/2025/06/30/jasper-sleet-north-korean-remote-it-workers-evolving-tactics-to-infiltrate-organizations/ , who use fraudulent identities to land real jobs. Microsoft says suspected AI-assisted resume workflows have made its personas faster to produce, more numerous and better matched to each role over the past year, and that AI tools help it keep several fake workers consistent at once. Across the groups, Microsoft lists AI being used to write resumes and realistic interview answers, help with coding tests, translate and adjust tone, and alter profile photos, video, voice and backgrounds. It also spotted possible AI-made voice and video from Emerald Sleet, though it couldn’t judge how much that was used. A hundred lures in minutes The clearest sign of automation came from Onyx Sleet. Microsoft found more than 100 PDF lure files from August and September, each carrying target-specific details, with metadata showing dozens were created within minutes of each other, “highly likely to be the output of an AI platform”. The files fed high-volume phishing against South Korean users, and lures that can be remade that fast are harder to detect and disrupt, Microsoft says. Diamond Sleet, meanwhile, has used AI for reconnaissance and technical work while setting up fake communications technology companies, complete with websites and personas, to approach telecoms firms as would-be business partners. Malware built with AI coding tools AI coding platforms “such as Cursor” have likely helped Jade Sleet, Coral Sleet, Pearl Sleet and Sapphire Sleet write, convert and debug code, add persistence and obfuscation, and quickly rebuild their tools after defenders block them, Microsoft says. It believes Sapphire Sleet likely used AI in an August 2026 compromise aimed at Rust developers, whose malware was “a marked improvement” on the group’s earlier campaigns. Since April, Coral Sleet has been trojanising private GitHub repositories, a capability Microsoft says was “highly likely engineered using an AI-enabled development platform”. The newest step is agentic. Since late October, Onyx Sleet and Pearl Sleet have been using ARTEX, the open-source agentic AI penetration-testing framework that Microsoft tied last week to a China-linked group’s cloud break-ins https://madrobot.blog/2026/10/22/microsoft-storm-0940-artex-ai-hacking-tool-connectwise-supply-chain-attack-china/ , and which has also been linked to attacks on Japanese firms https://madrobot.blog/2026/10/21/artex-chinese-ai-hacking-tool-japan-cyberattacks-gmo-korea-banks/ and four South Korean banks https://madrobot.blog/2026/10/02/south-korea-banks-shinhan-kb-kookmin-hana-hacked-ai-tool-artex-suspected/ . Even so, Microsoft says North Korea’s AI-enabled operations “remain human-directed and have not become fully autonomous”. What Microsoft tells employers to check Alongside Defender detections for each of the eight groups and for the malware in the Rust campaign, Microsoft repeats its hiring checks. It says workers supplied through staffing companies deserve extra scrutiny, as they are “the easiest avenue for North Korean workers to infiltrate target companies”. Employers should check that a candidate’s profiles and phone number aren’t shared with other accounts, call references by phone or video rather than only emailing them, and see the person on camera across several calls, treating claimed camera or microphone trouble as a red flag. The report doesn’t say whether any AI provider has closed the groups’ accounts. Why it matters North Korea’s hacking is a revenue engine for a sanctioned state, and Microsoft’s report suggests AI is mostly making the same schemes faster and cheaper: more fake recruiters, more convincing fake workers, more lures. For companies hiring remote developers, the job interview is now part of the attack surface. Sources: Microsoft Threat Intelligence, Tracking AI adoption in North Korean threat actor tradecraft October 29, 2026 https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/ ; Microsoft Threat Intelligence on Jasper Sleet June 30, 2025 https://www.microsoft.com/en-us/security/blog/2025/06/30/jasper-sleet-north-korean-remote-it-workers-evolving-tactics-to-infiltrate-organizations/ .