North Korean hackers are using AI to produce dozens of customized lures in minutes and run recruitment campaigns through multiple fake businesses, according to Microsoft Threat Intelligence. Microsoft identified Onyx Sleet generating those lures and Jade Sleet launching campaigns involving three front companies within one week, illustrating how the tools are speeding up established attacks.
Microsoft assesses that people still direct these operations and that they have not reached full autonomy. The company says AI primarily helps the groups pursue their existing objectives, including raising money for the regime and gathering intelligence. Organizations commonly targeted include financial businesses, cryptocurrency companies, software suppliers and government bodies, with social engineering and malware remaining central to the groups’ methods.
Read more: Microsoft Paid $2.3 Million to Hackers Who Found 80 Critical Cloud Flaws
Between June 8 and June 12, 2026, Microsoft observed Jade Sleet approaching people at businesses working in areas including blockchain and cybersecurity with purported job opportunities. The group impersonated recruiters representing a fake business presented as working on blockchain intelligence with AI, using tailored web domains and social profiles to arrange interviews. Microsoft assesses that its similar activity involving two other front companies during that period reflects AI helping it research industries and expand outreach.
Microsoft places Jade Sleet, Jasper Sleet and Coral Sleet in its most established adoption category, assessing that AI is embedded throughout their operations. Coral Sleet quickly developed a capability for inserting malicious changes into private code repositories, while Jasper Sleet continues using generative AI to construct fictitious online identities. Microsoft says suspected AI assistance with Jasper Sleet’s resume preparation has improved the pace, volume and relevance of that work over the past year.
Onyx Sleet and Pearl Sleet are also using ARTEX, an open-source framework for agentic AI penetration testing, in their operations, Microsoft says. In a separate October 21 account, Microsoft described China-state aligned Storm-0940 using ARTEX to automate attacks against hundreds of organizations worldwide as early as September 2026. Some of those attacks secured privileged access to cloud infrastructure, according to that earlier assessment.
Microsoft ranks Diamond Sleet among the groups rapidly adopting AI across several operational functions, including work on targeting, fabricated personas and front businesses. Since August 2026, the company has observed that group resume targeting oil and gas organizations for the first time since 2023, alongside continued targeting of defense-related organizations.
