North Korean threat actors are using AI across more of their cyber operations, according to new findings from Microsoft Threat Intelligence. Microsoft assesses overall adoption as high, but says the activity remains directed by people rather than operating autonomously.
Microsoft places Jade Sleet, Coral Sleet and Jasper Sleet at its highest adoption stage, meaning AI is embedded in their routine workflows. It says Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet are adopting AI rapidly across multiple functions, while Emerald Sleet uses it in selected activities.
AI speeds up targeting and phishing
Between June 8 and June 12, 2026, Jade Sleet used three front companies in job-themed outreach to people at organizations involved in cybersecurity, AI, blockchain and recruitment. Microsoft assesses that generative AI helped the group develop industry knowledge and tailor its targeting at that pace.
Microsoft also identified more than 100 target-specific PDF lures attributed to Onyx Sleet that were created in August and September 2026. File metadata showed dozens were made within minutes. Microsoft says the files were highly likely produced with an AI platform and supported phishing campaigns against South Korean users.
Groups use AI in software development
Since April 2026, Coral Sleet has used a new process to add malicious code to private GitHub repositories and incorporate them into its existing malware chain, Microsoft says. The company assesses that the capability was highly likely built with an AI-enabled development platform. It also found evidence that Sapphire Sleet likely used AI during an August 2026 compromise involving Rust software.
Microsoft says the groups primarily use AI to speed up existing methods, including social engineering, malware delivery and the use of legitimate tools. Their common targets include cryptocurrency and financial organizations, technology companies, government entities and education-related organizations.
Since late October 2026, Microsoft has observed Onyx Sleet and Pearl Sleet using ARTEX, an open-source agentic AI penetration-testing framework, in their operations. The company says Microsoft Defender customers can refer to its applicable detections for the threats described.
