Microsoft Rates AI Adoption Across Eight North Korean Hacking Groups as High, and Says Two Have Started Using the ARTEX Agent Framework
Microsoft Threat Intelligence says AI adoption across North Korean threat actors is high: it places Jade, Coral and Jasper Sleet at its top 'operationalized' stage, four more groups at 'accelerating' and one at 'expanding', with none left at 'emerging'. It says Onyx Sleet and Pearl Sleet have used the open-source ARTEX agentic penetration-testing framework since late October 2026, but that the operations remain human-directed rather than autonomous.
Microsoft's scorecard shows North Korean operators using AI mainly to do familiar work faster. Every group it tracks has moved past experimentation, yet the examples are familiar playbooks such as fake recruiters, phishing lures and supply-chain malware produced in larger batches. The newer signal is ARTEX, the agentic framework Microsoft had already tied to a China-aligned supply-chain attack, now appearing in North Korean operations as well.
Microsoft's adoption scale#
Microsoft Threat Intelligence assesses overall AI adoption across North Korean threat actors as high, it said in a report published October 29. It places high-impact groups on four stages: emerging, expanding, accelerating and operationalized. Jade Sleet, Coral Sleet and Jasper Sleet have operationalized AI across their entire operations, Microsoft says, while Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet are at the accelerating stage and Emerald Sleet at the expanding stage. Microsoft has not assessed any North Korean group as still at the emerging stage.
What Microsoft says it observed#
Microsoft says it identified more than 100 PDF lure files attributed to Onyx Sleet, created in August and September 2026 with target-specific details, and that metadata showed dozens created in rapid succession within minutes, "highly likely to be the output of an AI platform." The lures supported phishing against South Korean users, Microsoft says. Between June 8 and June 12, 2026, Jade Sleet ran job-themed targeting through three front companies, which Microsoft attributes to generative AI speeding up its workflow.
Microsoft says AI-assisted development platforms, naming Cursor as an example, have likely helped Jade Sleet, Coral Sleet, Pearl Sleet and Sapphire Sleet generate, debug and refactor code and assist with obfuscation. Since late October 2026, it has identified Onyx Sleet and Pearl Sleet using the open-source agentic penetration-testing framework ARTEX in operations. CrowdStrike separately reported that a China-nexus group used ARTEX against more than 200 organizations.
The 100-plus lures made within minutes of each other point to where defenders feel this first: volume. Phishing filters and recruiters screening applicants face more tailored material per attacker hour, even if each lure is no more sophisticated than before. Microsoft does not give a before-and-after count, so the size of the increase is not known.
Despite this, Microsoft assesses that AI-enabled operations "remain human-directed and have not become fully autonomous."
JKN, a Korean outlet, reported the same findings on October 30, including the more than 100 PDF lures, the three front companies and ARTEX use by Onyx Sleet and Pearl Sleet.
Limits#
- The stage assignments and the "likely" AI attributions are Microsoft's own assessments; Microsoft gives no victim counts, and no other threat-intelligence firm has published confirmation of the assessments.
- Microsoft does not say how it determined that specific AI platforms were used, beyond activity patterns and file metadata.
- The report also promotes Microsoft's own security products in its mitigation guidance.