North Korean Hackers Scale Up With AI, Microsoft Says

North Korean state-backed hacking groups are using AI to run their usual playbook faster and at greater scale, according to a new assessment from Microsoft Threat Intelligence published on 29 October. The tools help them write job lures, maintain fake identities and build malware, but Microsoft says the people behind the keyboard are still in charge.

“Despite threat actors’ adoption of AI, Microsoft Threat Intelligence assesses that AI-enabled operations remain human-directed and have not become fully autonomous,” the report says. Microsoft describes AI as “a force multiplier” that helps the groups “accelerate and scale established workflows”.

Microsoft’s view is that the goals have not changed. AI adoption “largely supports existing goals and targeting priorities rather than representing a shift in actor motivations”, it says. Those goals are raising money for the regime, gathering strategic intelligence and, in some cases, disruptive or destructive attacks. The usual targets remain cryptocurrency and financial firms, IT companies and software supply chains, government bodies and education. Microsoft Threat Intelligence shared the findings on X, saying the report includes mitigation guidance and detections for defenders.

How Microsoft rates each group

Microsoft rates overall AI adoption across North Korean groups as high, but uneven. It sorts the groups it tracks into four stages:

Operationalised: Jade Sleet, Coral Sleet and Jasper Sleet, which Microsoft says use AI across their entire operations.
Accelerating: Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet, which are adopting it quickly across several functions.
Expanding: Emerald Sleet, which uses AI in some workflows but with less impact so far.
Emerging: no North Korean group, in Microsoft’s assessment, is still at the experimental stage.

What the groups are doing with it

Most examples in the report involve speed. Between 8 and 12 June 2026, Microsoft says, Jade Sleet posed as recruiters for a spoofed “AI-powered blockchain intelligence company” to approach people in cybersecurity, AI, blockchain and recruitment, then ran similar campaigns through two more front companies in the same week. Onyx Sleet produced “over 100 PDF lure files” in August and September aimed at South Korean users, with file metadata showing “dozens of files at a time in rapid succession within minutes”.

Jasper Sleet, the group Microsoft links to fake remote IT workers, uses AI to build personas and CVs and to keep its many fake workers consistent. Emerald Sleet shows “possible synthetic media generation, focused on AI-created voice and video”, though Microsoft says it could not determine the full impact. Diamond Sleet has returned to targeting the oil and gas sector for the first time since 2023 and has set up fake telecoms companies.

On malware, Microsoft says AI-assisted development platforms, “such as Cursor”, have likely helped Jade, Coral, Pearl and Sapphire Sleet generate, debug and rework code. It says Sapphire Sleet likely used AI in an August 2026 attack on Rust developers, and that Coral Sleet’s method of trojanising private GitHub repositories, in use since April, was “highly likely engineered using an AI-enabled development platform”. Since late October, Onyx and Pearl Sleet have also been using ARTEX, an open-source AI agent framework for penetration testing.

Why faster attacks change the defender’s job

The finding that matters most for defenders is the one that sounds least dramatic. Microsoft is not describing machines running attacks on their own. It is describing human operators who can now produce a convincing recruiter, a tailored CV or a fresh batch of phishing files in minutes rather than days. Microsoft says the human operators “likely continue to direct intent and objectives”.

That shifts the pressure onto the checks that rely on spotting effort. A clumsy email or a thin online profile used to be a warning sign. When lures are tailored in bulk and personas are maintained by software, those signals fade, and blocking one campaign matters less when the next can be rebuilt quickly. Microsoft makes this point itself, saying AI helps the groups “rapidly pivot in reaction to defensive measures”.

North Korea’s fake IT worker schemes show why hiring is now a security issue. The US Treasury recently sanctioned 10 people over North Korean IT worker schemes, and US authorities charged 14 people and raided “laptop farms” in Texas. Microsoft’s report suggests AI makes such personas cheaper to run. It fits a wider pattern too: Kaspersky recently said Lazarus used post-quantum cryptography in attacks on Korean firms, and Straiker said a cybercrime group used AI agents in attacks on banks.

Microsoft’s advice to employers and security teams

Much of Microsoft’s guidance is about recruitment. It suggests employers:

Apply more scrutiny to staff hired through staffing companies, which Microsoft calls the easiest route in for North Korean workers.
Check that a candidate’s social media and professional profiles are not near-copies of other people’s, and that their phone number is not shared with other accounts.
Check CVs and background checks for consistent names, addresses and dates, and call references by phone or video rather than relying on email.
Search whether the same persona is employed at several companies.
See candidates on camera across several video calls, and treat repeated claims of camera or microphone problems as a red flag.
Confirm a real digital footprint, including a non-VOIP phone number, a home address and social media accounts.

For wider defence, Microsoft recommends phishing awareness training, blocking the device code sign-in flow wherever possible, patching internet-facing systems quickly and keeping them behind a secure network boundary, and keeping antivirus and endpoint detection switched on. Its report also lists detections for each group.