Microsoft Rates AI Adoption Across Eight North Korean Hacking Groups as High, and Says Two Have Started Using the ARTEX Agent Framework
Microsoft Threat Intelligence says AI adoption across North Korean threat actors is high: it places Jade, Coral and Jasper Sleet at its top 'operationalized' stage, four more groups at 'accelerating' and one at 'expanding', with none left at 'emerging'. It says Onyx Sleet and Pearl Sleet have used the open-source ARTEX agentic penetration-testing framework since late October 2026, but that the operations remain human-directed rather than autonomous.
Microsoft's scorecard is less about what North Korean operators can now do than how fast they do what they already did. Every group it tracks has moved past experimentation, yet the examples are familiar playbooks such as fake recruiters, phishing lures and supply-chain malware produced in larger batches. The newer signal is ARTEX, the agentic framework Microsoft had already tied to a China-aligned supply-chain attack, now appearing in North Korean operations as well.
Microsoft's adoption scale#
Microsoft Threat Intelligence assesses overall AI adoption across North Korean threat actors as high, it said in a report published October 29. It places high-impact groups on four stages: emerging, expanding, accelerating and operationalized. Jade Sleet, Coral Sleet and Jasper Sleet have operationalized AI across their entire operations, Microsoft says, while Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet are at the accelerating stage and Emerald Sleet at the expanding stage. Microsoft has not assessed any North Korean group as still at the emerging stage.
What Microsoft says it observed#
Microsoft says it identified more than 100 PDF lure files attributed to Onyx Sleet, created in August and September 2026 with target-specific details, and that metadata showed dozens created in rapid succession within minutes, "highly likely to be the output of an AI platform." The lures supported phishing against South Korean users, Microsoft says. Between June 8 and June 12, 2026, Jade Sleet ran job-themed targeting through three front companies, which Microsoft attributes to generative AI speeding up its workflow.
Microsoft says AI-assisted development platforms, naming Cursor as an example, have likely helped Jade Sleet, Coral Sleet, Pearl Sleet and Sapphire Sleet generate, debug and refactor code and assist with obfuscation. Since late October 2026, it has identified Onyx Sleet and Pearl Sleet using the open-source agentic penetration-testing framework ARTEX in operations. CrowdStrike separately reported that a China-nexus group used ARTEX against more than 200 organizations.
Despite this, Microsoft assesses that AI-enabled operations "remain human-directed and have not become fully autonomous."
JKN, a Korean outlet, reported the same findings on October 30, including the more than 100 PDF lures, the three front companies and ARTEX use by Onyx Sleet and Pearl Sleet.
Limits#
- The stage assignments and the "likely" AI attributions are Microsoft's own assessments; Microsoft gives no victim counts, and we found no independent confirmation from another threat-intelligence firm.
- Microsoft does not say how it determined that specific AI platforms were used, beyond activity patterns and file metadata.
- The report also promotes Microsoft's own security products in its mitigation guidance.