Microsoft Says Three North Korean Hacking Groups Have Integrated AI Into Cyberattacks

Microsoft has warned that North Korean cybercriminal groups are increasingly using artificial intelligence to improve the speed, scale and sophistication of their operations. In a report published on October 29, 2026, Microsoft Threat Intelligence identified eight North Korean-linked threat groups adopting AI across different stages of their cyber activities. Three groups — Jade Sleet, Coral Sleet and Jasper Sleet — were classified at the highest level of AI adoption, meaning the technology has become part of their routine operations. The findings suggest that AI is no longer being used only for occasional research or content generation but is increasingly supporting multiple stages of cyberattacks.

According to Microsoft, the hacking groups are using AI to conduct reconnaissance, research potential targets and create highly personalised phishing messages. The technology also helps them produce fake recruitment offers, generate convincing professional profiles and communicate with victims in different languages. One example involved Jade Sleet, which reportedly used three front companies between June 8 and June 12, 2026, to approach individuals working in cybersecurity, artificial intelligence, blockchain and recruitment. Microsoft believes AI helped the group rapidly develop industry-specific knowledge and create convincing job-related approaches designed to establish trust with potential victims.

The report also highlighted the growing use of AI to produce malicious documents and improve software-based attacks. Microsoft identified more than 100 customised PDF documents attributed to Onyx Sleet, created between August and September 2026 to target South Korean users. Metadata indicated that dozens of the documents were generated within minutes, suggesting the use of automated AI-assisted workflows. The company also identified evidence that North Korean-linked groups were using AI coding tools such as Cursor to generate code, fix errors, modify malware and improve techniques designed to avoid security detection. These developments could make cyberattacks faster to organise and more difficult for organisations to identify.

Another significant finding involves the use of agentic AI tools in actual cyber operations. Microsoft reported that Onyx Sleet and Pearl Sleet had begun using an open-source AI penetration-testing framework known as ARTEX in their activities since late October 2026. The framework can support automated security-testing workflows, although Microsoft did not conclude that the groups were conducting completely autonomous attacks. The company emphasised that human operators still direct the objectives and major decisions behind these operations. Four additional groups — Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet — were classified as rapidly expanding their AI adoption, while Emerald Sleet was placed at an earlier stage.

Microsoft’s findings raise concerns for businesses, financial institutions, cryptocurrency platforms and government organisations because AI-assisted cybercrime can increase the volume and personalisation of attacks. The company recommends stronger identity verification during recruitment, improved phishing detection, regular software updates and more effective malware protection. Organisations are also being encouraged to monitor suspicious activity involving employees, contractors and external service providers. Although AI is helping attackers become more efficient, Microsoft says the observed operations remain largely human-directed rather than fully autonomous. The report demonstrates how artificial intelligence is changing the cybersecurity landscape and why organisations must strengthen their defences as criminal groups adopt increasingly sophisticated digital tools.