North Korean threat actors are scaling attacks with AI

Microsoft Threat Intelligence has published new research showing that North Korean threat actors are increasingly embedding AI into day-to-day cyber operations. For defenders, the key takeaway is not that attacks are becoming fully autonomous, but that AI is helping attackers move faster, produce more convincing lures, and scale established tradecraft.

What’s new

Microsoft assesses overall AI adoption among North Korean threat actors as high, with different groups at different stages of maturity:

• Operationalized: Jade Sleet, Coral Sleet, and Jasper Sleet have integrated AI across routine workflows.
• Accelerating: Diamond Sleet, Onyx Sleet, Pearl Sleet, and Sapphire Sleet are rapidly expanding AI use.
• Expanding: Emerald Sleet is using AI in selected activities, but not yet broadly.
• Emerging: Microsoft has not currently placed any tracked actors in this stage.

The report highlights several ways AI is being used:

AI-assisted targeting and reconnaissance

Threat actors are using generative AI to research organizations, employees, technologies, wallets, exchanges, APIs, and cloud services. This helps them build more tailored phishing lures, front companies, fake recruiter personas, and infrastructure aligned to specific targets.

AI-assisted social engineering

AI is improving the speed and quality of deceptive content, including recruiter outreach, job applications, and persona development. Microsoft noted that Jade Sleet launched campaigns through three front companies in a single week, while Onyx Sleet generated dozens of tailored lures in minutes.

AI-assisted tooling and development

Actors are also using AI to support malware, tooling, and software development tasks. Coral Sleet, for example, rapidly developed capability to trojanize private source code repositories. Microsoft also observed Onyx Sleet and Pearl Sleet using the open-source agentic AI penetration testing framework ARTEX.

AI for scale and efficiency

The broader trend is clear: AI is acting as a force multiplier. It supports repetitive tasks, speeds analysis, and enables faster campaign execution without changing the underlying human-directed nature of these operations.

Why this matters for defenders

For IT and security administrators, this means familiar attack patterns may arrive faster and with greater personalization. Organizations in cryptocurrency, finance, IT, software supply chains, government, and education should expect more polished phishing, identity deception, and reconnaissance activity.

Recommended next steps

• Review protections for phishing, identity-based attacks, and recruiter-themed social engineering.
• Strengthen monitoring for suspicious domains, spoofed companies, and abnormal cloud or developer activity.
• Ensure Microsoft Defender detections and threat intelligence workflows are enabled and up to date.
• Reassess user awareness training to cover AI-enhanced lures and fake job outreach.
• Apply stricter controls around source code repositories, privileged access, and third-party collaboration.

AI is not replacing operators in these campaigns, but it is making established North Korean tradecraft faster, more scalable, and harder to ignore.