# Microsoft: eight North Korean groups use AI, two now run ARTEX

> Microsoft Threat Intelligence rates eight North Korean threat groups on a four-stage AI adoption scale, with none at the earliest stage.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Attack
- **Published by:** Microsoft
- **Disclosed:** 2026-10-29
- **Affects:** Cursor, ARTEX, GitHub
- **Research by:** Microsoft Threat Intelligence
- **Primary source:** https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/
- **Page:** https://theinjection.dev/items/microsoft-north-korea-ai-tradecraft/

Microsoft Threat Intelligence rates North Korean threat actors' AI adoption as high, naming eight groups and placing each on a four-stage scale. Microsoft says the operations stay human-directed and are not fully autonomous.

## What happened

Microsoft Threat Intelligence published its assessment of North Korean AI adoption on October 29, 2026, naming eight threat groups and sorting them into four adoption stages. Microsoft rates the overall level of adoption as high and says no group sits at the earliest stage. The report also states that these AI-enabled operations remain human-directed and have not become fully autonomous.

## How it works

The groups apply AI at the reconnaissance and content stages rather than for autonomous intrusion. Microsoft reports that Onyx Sleet produced more than 100 PDF lure files carrying target-specific details across August and September 2026, often dozens within minutes, and that Jade Sleet ran job-themed targeting through three front companies in a single week in June 2026. Coral Sleet has built a workflow to trojanize private GitHub repositories, which Microsoft says likely uses an AI development platform. Onyx Sleet and Pearl Sleet have both adopted ARTEX, the open-source agentic penetration testing framework, since late October 2026.

## Who is affected

Organizations in the sectors these groups already target are exposed, including software and technology firms whose developers are approached with job-themed lures, companies hiring remote IT workers, and telecommunications, oil and gas firms. Microsoft reports that Diamond Sleet returned to oil and gas targeting from August 2026 and created fake communications technology companies to approach telecom firms. Jasper Sleet builds fake personas and resume workflows, and has tooling to manage several worker personas at once.

## What to do

Verify remote-hire identities through video calls, phone numbers and digital footprints, and scrutinize resumes routed through staffing companies, which Microsoft lists first among its hiring recommendations. Enable Safe Links, Safe Attachments and zero-hour auto purge, and block device code flow where possible. Microsoft also lists two Defender for Cloud alerts for this activity, Possible AI Tools Reconnaissance Detected and Possible Secret Reconnaissance Detected.

## Quick facts

- **Groups named:** Jade, Jasper, Coral, Onyx, Pearl, Diamond, Sapphire and Emerald Sleet
- **Adoption rating:** High overall, on a four-stage scale, with no group rated emerging
- **AI tools observed:** Cursor for development, ARTEX for agentic penetration testing
- **Lure volume:** More than 100 PDF lures from Onyx Sleet across August and September 2026
- **Autonomy:** Human-directed, not fully autonomous, per Microsoft
- **Found by:** Microsoft Threat Intelligence

## Sources

1. [Microsoft Report](https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/)
2. [Microsoft on ARTEX](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)