Illustration, AI-generated from the story text. Tap a panel to read the story through it.

1 / 4Every North Korean hacking group Microsoft tracks now uses AI, and two run an open-source attack agent×

The assessment

Microsoft Threat Intelligence published its assessment on Thursday: of the eight North Korean groups it tracks, three have built AI into routine work (Jade Sleet, Coral Sleet and Jasper Sleet), four are accelerating and one is expanding. None is still at the experimenting stage.

How they use it

Jasper Sleet uses AI to run fake remote IT workers, writing résumés and managing several personas at once. Onyx Sleet made more than 100 target-specific PDF lures in August and September, often dozens within minutes.

The tools

Coral Sleet built a workflow to plant malicious code in private GitHub repositories. Since late October, Pearl Sleet and Onyx Sleet have used ARTEX, an open-source agentic penetration-testing framework.

The limits

Microsoft says the operations remain "human-directed and have not become fully autonomous." The FBI blamed Jade Sleet's alter ego, TraderTraitor, for the $6.3 billion Binance theft on Saturday.

Sources and the full story

‹›

Every North Korean hacking group Microsoft tracks now uses AI, and two run an open-source attack agent

Microsoft Threat Intelligence published its assessment on Thursday: of the eight North Korean groups it tracks, three have built AI into routine work (Jade Sleet, Coral Sleet and Jasper Sleet), four are accelerating and one is expanding. None is still at the experimenting stage. Jasper Sleet uses AI to run fake remote IT workers, writing résumés and managing several personas at once. Onyx Sleet made more than 100 target-specific PDF lures in August and September, often dozens within minutes. Coral Sleet built a workflow to plant malicious code in private GitHub repositories. Since late October, Pearl Sleet and Onyx Sleet have used ARTEX, an open-source agentic penetration-testing framework.

Microsoft says the operations remain "human-directed and have not become fully autonomous." The FBI blamed Jade Sleet's alter ego, TraderTraitor, for the $6.3 billion Binance theft on Saturday. SourcesA

Sources

• ATracking AI adoption in North Korean threat actor tradecraft (Microsoft Threat Intelligence)microsoft.com

This story ran in the Morning Brief of November 2nd 2026.