North Korean Hackers Are Using AI to Speed Up and Scale Their Attacks

Microsoft Threat Intelligence says North Korean threat actors are expanding their use of AI, with varying levels of adoption. Rather than changing what these groups want, AI acts as a force multiplier that speeds up and scales workflows they already use. Microsoft assesses that AI-enabled operations remain human-directed and have not become fully autonomous.

The examples are concrete. Jade Sleet launched campaigns through three front companies in a single week. Onyx Sleet generated dozens of tailored lures in minutes. Coral Sleet rapidly built a new capability to trojanize private source code repositories. Diamond Sleet used AI to improve targeting, including persona development and front company creation. Onyx Sleet and Pearl Sleet are also using ARTEX, an open-source agentic AI penetration testing framework, which suggests a readiness to adopt new AI tools quickly.

The underlying goals are unchanged. Operating under extensive international sanctions, North Korea uses cyber operations to generate revenue for the regime, collect strategic intelligence and, in some cases, pursue disruptive or destructive aims. Tradecraft still rests on social engineering, malware delivery and abuse of legitimate tools. Common targets include cryptocurrency and financial organisations, IT companies and software supply chains, government entities, and education-related organisations.