Microsoft reports wider AI use by North Korean hacking groups

Microsoft’s report, released on the 29th local time, described AI use in phishing, identity spoofing, malware creation and software supply-chain attacks.[1] The company assessed eight North Korean hacking groups and placed three—Jade Sleet, Coral Sleet and Jasper Sleet—in its highest adoption tier, meaning AI is integrated into routine attack tasks.[1][2] Four groups were in an acceleration phase, where AI use is spreading quickly, and one was in an expansion phase, where AI has been introduced into some tasks.[1] These categories describe different levels of adoption, rather than a claim that every group uses AI in the same way.

Microsoft found that one North Korean group created more than 100 PDF phishing-lure documents tailored to targets in August and September.[1] It found signs that dozens of those documents were generated within minutes.[1] Microsoft said AI helped the group produce tailored documents quickly and increase the scale and efficiency of its phishing attacks.[1] Separately, Microsoft confirmed that a North Korean group used three front companies to send fake job offers from June 8 to 12 to workers in AI, blockchain and cybersecurity.[1] Chosun reported that distribution of the South Korea-targeted phishing documents and any resulting damage had not been confirmed.[2]

Microsoft assessed that North Korean hackers may have used AI coding tools such as Cursor to help write malware, fix code errors and develop techniques to evade security detection.[1] It also said Onyx Sleet and Pearl Sleet have used ARTEX, an open-source AI penetration-testing framework, in real operations since late October.[1] In an attack procedure introduced in April, Coral Sleet embedded malicious code in companies’ private GitHub repositories, according to Microsoft’s assessment.[2] Microsoft said the capability’s rapid development and widespread use strongly suggested AI-based development tools were involved, but did not identify the companies targeted or the scale of damage.[2]

Microsoft said the groups have not reached fully autonomous attacks that run without human involvement.[1] It said humans still set attack objectives and make major decisions in North Korean hacking operations.[2] The report also estimated that Sapphire Sleet used AI to improve malware functionality in an August attack on software developers.[2] As a separate earlier example, Chosun reported a confirmed case in July of the previous year involving malicious emails with AI-generated images that impersonated a South Korean military-related institution.[2] Microsoft advised companies to verify job applicants’ identities and work histories and strengthen security systems and malware detection.[1]