North Korean hackers embed AI in their operations

Three of eight North Korean groups run AI across operations

Every one of the eight groups Microsoft assessed has adopted AI, and none is still at the experimental stage. Microsoft Threat Intelligence, the company's security research team, laid out the findings in a blog post on October 29, 2026. It judged AI use across North Korea's hacking groups as a whole to be high.

Microsoft gives North Korean groups names ending in "Sleet." For this report it looked at eight groups with the biggest impact and placed each on a four-stage scale based on how they use generative AI and agentic AI, meaning AI that carries out multistep tasks on its own once given instructions.

Jade Sleet, Coral Sleet and Jasper Sleet reach the top stage

The other five groups split between the accelerating stage, with four groups, and the expanding stage, with Emerald Sleet alone. Jade Sleet, Coral Sleet and Jasper Sleet sit at the top, a stage Microsoft calls operationalized. The table below shows how Microsoft defines each stage and which groups fall into it.

Microsoft's four stages of AI adoption and the North Korean groups in each

Stage	What it means	Groups
Operationalized	AI is part of everyday work and built into existing processes	Jade Sleet, Coral Sleet, Jasper Sleet
Accelerating	AI is spreading quickly across several functions	Diamond Sleet, Onyx Sleet, Pearl Sleet, Sapphire Sleet
Expanding	AI is used in some activities but not yet across wider workflows	Emerald Sleet
Emerging	AI use is limited or experimental	None

The three top-stage groups often run attacks that depend on tricking people and impersonating someone else. Microsoft says AI speeds these up by tailoring lures and fake personas to each target. For Emerald Sleet, it found signs of AI in some workflows but not the level of adoption or impact seen in the other groups.

Humans still direct every AI-enabled operation

North Korea's goals have not changed, and AI mainly helps the same operations run faster and at a larger scale. Under heavy international sanctions, the country's hackers chiefly raise money for the regime and gather strategic intelligence, and some also aim to disrupt or destroy systems for political reasons.

Microsoft sees AI as a boost to those existing aims rather than a change in motive. The groups most often go after four kinds of organizations:

• Cryptocurrency and financial firms
• IT companies and software supply chains
• Government agencies
• Schools and other education-related organizations

Their core methods are also the same as before: social engineering, malware delivery and misuse of legitimate software. Microsoft adds that these AI-assisted operations are still run by people and have not become fully autonomous.

Fake recruiters and fake applicants are built with AI

The groups use AI to produce everything from job ads and resumes to interview answers, deceiving both job seekers and the companies that hire. According to Microsoft, Sapphire Sleet, Jade Sleet and Coral Sleet pose as employers and run fake hiring processes to reach people and organizations, while Jasper Sleet uses stolen or invented identities to get real remote jobs.

In each case, AI makes the fake messages and personas more convincing and helps the attackers avoid raising suspicion during conversations. Microsoft lists these uses:

• Writing phishing, recruiter and investment lures aimed at specific people
• Translating messages and adjusting tone so impersonation in a foreign language reads naturally
• Drafting resumes, career histories and answers for job interviews
• Getting through coding tests and juggling several fake worker identities
• Editing profile photos, video, voice and backgrounds

Jade Sleet posed as three front companies in one week

Its targets worked at cybersecurity, AI, blockchain and talent recruitment companies. Microsoft observed the activity between June 8 and June 12, 2026. Jade Sleet pretended to be hiring software engineers for a made-up firm that claimed to use AI for blockchain analysis, and it set up interviews with people who replied.

To look credible, the group registered matching domains, built social media profiles and showed knowledge of the industry. In the same short window it ran the same kind of outreach under two more front companies, which are fake businesses set up to hide who is really behind them. Microsoft reads that pace as a sign that generative AI helped Jade Sleet learn each industry quickly and widen its reach.

Front companies are not unique to Jade Sleet. Since August 2026, Diamond Sleet has created fake communications technology firms, complete with websites and staff personas, to approach telecom companies as would-be business partners.

Jasper Sleet uses AI to land remote jobs

Over the past year it has prepared fake personas faster and in greater numbers, and it uses fraudulent identities to hold remote jobs. Microsoft believes the group now relies on generative and agentic AI to write resumes, which has also made each persona a closer fit for the job it applies to.

Jasper Sleet has built reusable tooling to send out more applications and to come across as a genuine candidate during hiring. Once hired, it uses AI to keep the tone and quality of work consistent across several fake workers.

Microsoft says AI coding tools helped build malware

Because AI coding tools let the groups rebuild their tools quickly, blocking one version no longer stops them for long. Microsoft found evidence that North Korean groups use AI-powered software to help write malware.

According to Microsoft, faster rebuilds make it easier to slip past detection and blocking. It believes Jade Sleet, Coral Sleet, Pearl Sleet and Sapphire Sleet used AI coding assistants such as Cursor for the following work:

• Generating, converting, debugging and rewriting code
• Writing scripts and commands, plus code that keeps malware running on a machine and hides what it does
• Tracking down errors and working out why their tools behave a certain way
• Porting features to other programming languages, libraries and environments

In August 2026, Sapphire Sleet likely used AI in a software supply chain attack aimed at Rust developers. The malware it deployed compiled .NET code on the fly after the break-in, most likely to avoid detection.

Coral Sleet has trojanized private GitHub repos since April

Microsoft says the technique Coral Sleet has run since April 2026 was highly likely built with an AI development platform. Coral Sleet plants malware in private GitHub repositories, the access-restricted spaces where developers store and share source code, and has wired that step into its existing infection chain. Microsoft points to how broad the technique is, how large it has grown and how fast it appeared.

Onyx Sleet produced dozens of PDF lures in minutes

In August and September 2026, Onyx Sleet created more than 100 target-specific PDF lures and used them to phish users in South Korea. A lure here is a document written to get a particular person to open it. File metadata showed the group turning out dozens of these PDFs back to back within minutes, which Microsoft calls highly likely to be AI output.

Because new lures can be generated or tweaked so quickly, Microsoft warns the campaigns may be harder to disrupt and detect. Since late October 2026, Onyx Sleet and Pearl Sleet have also been using ARTEX, an open-source penetration testing tool driven by AI agents.

What hiring companies and recruited employees can do

Companies should confirm that the people they hire are who they claim to be, and employees should not open job offers or code from strangers on the spot. Fake applicants like Jasper Sleet's land on the desks of companies that hire staff or contractors. Fake recruiters like Jade Sleet's reach individual employees, who then become the way in.

Japanese authorities have issued guidance on the same tactics. For companies, there is a July 31, 2026 joint advisory on North Korean IT workers from the National Police Agency (NPA) and four ministries, plus the NPA's Cyber Police Agency Letter 2026 Vol.17.

For employees, there is a December 24, 2024 advisory on the group TraderTraitor from the NPA, Japan's national cybersecurity center and the Financial Services Agency. Below are three steps for each side.

Companies: verify who you hire or contract

A candidate who avoids video meetings and asks to be paid in cryptocurrency shows the warning signs of a North Korean IT worker. The joint advisory says these workers pose as citizens of other countries to win jobs and lean on AI to hide who they are.

It also flags awkward or machine-translated profiles, rates well below the market and contacts that change depending on the time of day. Here are three checks a company can run.

Hold several video interviews and match faces to IDs

The advisory treats mismatches during video calls as a warning sign, such as a face that does not match the photo ID or footage that looks altered or AI-generated. Refusing to join video meetings at all is another sign.

Microsoft gives similar advice. Make sure the candidate appears on camera across several sessions, and treat repeated claims of camera or microphone trouble as a red flag.

Check phone numbers and IP addresses against the application

In the September 2026 issue of its Cyber Police Agency Letter, the NPA explains what to check when a candidate seems suspicious. Compare the IP address they connect from with where they say they live, and check whether they are using a VPN, which can make a connection appear to come from somewhere else.

The NPA also says to confirm that the contact phone number actually exists. Microsoft likewise suggests checking that a candidate has a home address, social media accounts and a real phone number rather than an internet-based VOIP line.

Treat requests for crypto or overseas payment as a red flag

The joint advisory lists a request to be paid in cryptocurrency as a warning sign. The NPA letter adds that candidates who insist on remote work or ask for crypto payments or transfers to overseas accounts deserve extra caution.

Paying a North Korean IT worker can break domestic law and lead to fines, even if the company does not know who the worker is. The advisory says that contracting with these workers and paying for their services may violate the laws of many countries, including Japan, so confirm identity before signing with anyone who wants to be paid in unusual ways.

Employees: be wary of job offers and code from strangers

Japanese authorities warn that attackers approach people on social media and get them to run code by asking for help with a bug. On December 24, 2024, the NPA and two other agencies identified TraderTraitor as the group that stole roughly 48.2 billion yen worth of cryptocurrency from the Japanese exchange DMM Bitcoin.

According to the advisory, TraderTraitor borrows other people's names and photos to pose as company executives and tailors its pitch to each target's background and skills. Employees can protect themselves with three habits.

Ask for a video call when approached on social media

The advisory tells employees to ask for a video call when someone reaches out on social media, and to treat repeated refusals as suspicious. It also suggests saving screenshots of the person's profile and your messages. The Jade Sleet campaign Microsoft described followed the same pattern, with fake recruiters contacting software engineers and booking interviews.

Read code before you run it

In the scenario the advisory describes, the attacker shares a program on GitHub, claims it has a bug and asks the target to run it, which infects the target's computer. Pressure to review or run code quickly is itself a warning sign.

The advisory says not to run code without checking it first and to open it in a code editor instead. Coral Sleet's habit of hiding malware in private repositories shows that a shared repository is no guarantee of safety either.

Test unfamiliar code in a virtual machine, not on a work PC

A virtual machine is a separate computer simulated inside your own. According to the advisory, attackers steal the credentials and session cookies stored on an infected PC and then impersonate the victim to get into work systems.

Running unfamiliar code on a work PC can expose saved credentials and give attackers a path into company systems. For that reason the advisory recommends running unfamiliar code on a computer other than your work PC, or inside a virtual machine.