Microsoft: eight North Korean groups use AI, two now run ARTEX
Microsoft Threat Intelligence rates eight North Korean threat groups on a four-stage AI adoption scale, with none at the earliest stage.
· Microsoft · Research by Microsoft Threat Intelligence
Microsoft Threat Intelligence rates North Korean threat actors' AI adoption as high, naming eight groups and placing each on a four-stage scale. Microsoft says the operations stay human-directed and are not fully autonomous.
01What happened
Microsoft Threat Intelligence published its assessment of North Korean AI adoption on October 29, 2026, naming eight threat groups and sorting them into four adoption stages. Microsoft rates the overall level of adoption as high and says no group sits at the earliest stage. The report also states that these AI-enabled operations remain human-directed and have not become fully autonomous.
02How it works
The groups apply AI at the reconnaissance and content stages rather than for autonomous intrusion. Microsoft reports that Onyx Sleet produced more than 100 PDF lure files carrying target-specific details across August and September 2026, often dozens within minutes, and that Jade Sleet ran job-themed targeting through three front companies in a single week in June 2026. Coral Sleet has built a workflow to trojanize private GitHub repositories, which Microsoft says likely uses an AI development platform. Onyx Sleet and Pearl Sleet have both adopted ARTEX, the open-source agentic penetration testing framework, since late October 2026.
03Who is affected
Organizations in the sectors these groups already target are exposed, including software and technology firms whose developers are approached with job-themed lures, companies hiring remote IT workers, and telecommunications, oil and gas firms. Microsoft reports that Diamond Sleet returned to oil and gas targeting from August 2026 and created fake communications technology companies to approach telecom firms. Jasper Sleet builds fake personas and resume workflows, and has tooling to manage several worker personas at once.
04What to do
Verify remote-hire identities through video calls, phone numbers and digital footprints, and scrutinize resumes routed through staffing companies, which Microsoft lists first among its hiring recommendations. Enable Safe Links, Safe Attachments and zero-hour auto purge, and block device code flow where possible. Microsoft also lists two Defender for Cloud alerts for this activity, Possible AI Tools Reconnaissance Detected and Possible Secret Reconnaissance Detected.
Sources 2 links, all fetched
- 1microsoft.comMicrosoft Report
- 2microsoft.comMicrosoft on ARTEX