Microsoft: North Korean hacking groups have embedded AI into their entire attack workflow, often targeting cryptocurrency and other sectors

Oct. 30 — According to Microsoft's security blog, Microsoft Threat Intelligence disclosed that North Korean hacking groups show an overall "high" level of AI adoption, with Jade Sleet, Coral Sleet and Jasper Sleet having embedded AI into their entire operational workflow. Specifically, Jade Sleet launched recruitment-themed attacks through three front companies within one week; Onyx Sleet produced more than 100 tailored PDF lure documents in August and September; and Coral Sleet is suspected of using an AI development platform to plant trojans in private GitHub repositories. Since late October, Onyx Sleet and Pearl Sleet have begun using ARTEX, an open-source agentic AI penetration-testing framework. Microsoft assesses that these operations remain human-led and are not yet fully autonomous. These campaigns typically target cryptocurrency and financial institutions, information technology companies and the software supply chain, government entities, and education-related organizations.