By Roman Aglaganov
North Korea’s state-backed hackers have not found new goals in AI, Microsoft says, but they are using it to reach the old ones faster and at greater scale. In a report published on 29 October, Microsoft Threat Intelligence describes how eight groups it tracks are using generative and agentic AI, and judges overall adoption among them to be high.
Four stages of adoption
Microsoft grades each group on a four-step scale. Three, which it calls Jade Sleet, Coral Sleet and Jasper Sleet, are at the top, “operationalized”, with AI built into routine work. Four more are “accelerating”, and one is “expanding”. The groups’ aims are the familiar ones: making money, collecting intelligence and sometimes disruptive or destructive attacks.
What the AI is used for
Deception: Groups use AI to research targets, write tailored phishing and fake job offers, translate and adjust the tone of messages, and build convincing personas. Jasper Sleet, which places North Korean IT workers in remote jobs abroad, uses it to create and keep consistent fake identities, including CVs and interview answers. One group produced more than 100 target-specific PDF lures in August and September, apparently in rapid bursts. Microsoft says another possibly used AI-generated voice and video, but could not determine the impact.
Code: Four groups likely used AI coding tools, including Cursor, to write, convert and debug malware, and AI helps them retool quickly once defenders spot them. Two groups have started using ARTEX, an open-source framework for AI-driven penetration testing.
Microsoft stresses a limit: the operations “remain human-directed and have not become fully autonomous.” That fits other recent reports, including CrowdStrike’s account of a China-linked group using AI agents, in which AI multiplies what a team can do rather than replacing it.
What defenders can do
Microsoft’s advice is mostly familiar, which is part of the point: patch exposed systems, train staff to spot phishing, and block risky sign-in methods. For hiring, it recommends checking remote candidates more carefully, including references, phone numbers, whether the camera is real and whether the person has a genuine online history. As fake applicants get more polished, those simple checks matter more.
