Tracking AI Adoption in North Korean Threat Actor Tradecraft
Tracking AI Adoption in North Korean Threat Actor Tradecraft
As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed, efficiency, and complexity of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying levels of adoption. Threat actors use AI as a force multiplier across their operations, particularly to accelerate and scale established workflows. 🚀
Recent activities illustrate this AI-enabled acceleration and scaling:
- Jade Sleet launched campaigns through three front companies in a single week.
- Onyx Sleet generated dozens of tailored lures in minutes.
- Coral Sleet rapidly built a new capability to trojanize private source code repositories.
- Diamond Sleet used AI to enhance tailored targeting workflows, including persona development and front company creation.
Further, Onyx Sleet and Pearl Sleet are leveraging the open-source agentic AI penetration testing framework ARTEX to conduct operations, further indicating North Korea’s willingness to quickly adopt new AI technologies for their operations.
Microsoft Threat Intelligence assesses the overall adoption of AI across North Korean threat actors as high, with threat actors such as Jade Sleet, Coral Sleet, and Jasper Sleet demonstrating an established use of AI across all operational workflows, alongside increasing adoption across the broader North Korean threat actor set.
AI adoption by North Korean threat actors therefore largely supports existing goals and targeting priorities rather than representing a shift in actor motivations. North Korean threat actors conduct cyber operations primarily to generate revenue for the regime, collect strategic intelligence, and, in some cases, pursue politically motivated disruptive or destructive objectives. Despite threat actors’ adoption of AI, Microsoft Threat Intelligence assesses that AI-enabled operations remain human-directed and have not become fully autonomous.
North Korean threat actors are increasingly integrating generative and agentic AI platforms into their operations, but the rate and maturity of adoption vary. Based on identified AI use, Microsoft Threat Intelligence assesses high-impact North Korean threat actors across four stages of adoption: emerging, expanding, accelerating, and operationalized.
Threat actors at the ‘Operationalized’ stage have embedded AI into routine operational workflows, using it as an established part of their existing processes. Microsoft Threat Intelligence assesses that the North Korean threat actors Jade Sleet, Coral Sleet, and Jasper Sleet have operationalized AI across their entire operations, which frequently encompass identity-based attacks built on deceptive social engineering.
Threat actors at the ‘Accelerating’ stage demonstrate rapid adoption of AI across multiple operational functions; Diamond Sleet, Onyx Sleet, Pearl Sleet, and Sapphire Sleet are at this stage. Those at the ‘Expanding’ stage are expanding their use of AI across selected operational activities, but adoption is not yet embedded across broader workflows. Microsoft Threat Intelligence assesses that Emerald Sleet is at the expanding stage of AI adoption.
Microsoft Threat Intelligence has identified North Korean threat actors using AI platforms to support a range of operational activities, from reconnaissance to developing social engineering content, maintaining fraudulent identities, supporting tool development, and scaling repetitive operational tasks. North Korean threat actors are scaling reconnaissance capabilities by using generative AI platforms, including gathering information on target organizations prior to launching social engineering operations.
For example, between June 8 and June 12, 2026, Jade Sleet conducted job-themed targeting against individuals across organizations involved in cybersecurity, AI, blockchain, and talent recruitment. Jasper Sleet also continues to leverage generative AI platforms to build fake digital personas. Additionally, several North Korean threat actors leverage AI-assisted social engineering and identity deception, using employment- and interview-themed techniques.
Sapphire Sleet, Jade Sleet, and Coral Sleet specifically use AI to improve the process of creating convincing lures, aid in the development of fake personas, and evade detection when interacting with targets. These activities include producing tailored phishing, recruiter, and investment lures, and creating job-themed payload-delivery content and malicious repository lures.