Microsoft says North Korean hacking groups have embedded AI across attack workflows

Microsoft’s threat intelligence team said North Korean hacking groups are using AI at a high level, with Jade Sleet, Coral Sleet, and Jasper Sleet integrating the technology across their full operational workflows. The company said these campaigns often target cryptocurrency among other sectors. Microsoft also outlined several recent cases. Jade Sleet launched job-themed attacks through three front companies within a single week. Onyx Sleet produced more than 100 customized PDF lure files between August and September. Coral Sleet was suspected of using an AI development platform to plant malware in private GitHub repositories. Since late October, Onyx Sleet and Pearl Sleet have also begun using ARTEX, an open-source agentic AI penetration testing framework. Despite the broader use of AI, Microsoft assessed that these operations are still directed by humans and have not become fully autonomous.