Microsoft’s Threat Intelligence unit has revealed that eight hacking groups linked to North Korea are now leveraging artificial intelligence to speed up their cyber‑operations. In a report published on October 29, 2026, the tech giant detailed how these cells are using generative AI to research targets, craft deceptive messages and even write malicious code at a pace previously unseen in the region’s cyber‑espionage campaigns.
AI‑Driven Tactics Across Multiple Groups
The eight groups are classified by how deeply AI is woven into their workflows. Three—Jade Sleet, Coral Sleet and Jasper Sleet—operate with AI fully integrated into every stage of their missions. They employ AI to create fake recruitment firms, draft convincing job offers and generate malicious code in minutes.
Four other cells—Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet—are in an “accelerated” phase, using AI to boost productivity. Onyx Sleet, for example, churned out more than 100 phishing PDFs in a matter of minutes between August and September, targeting South Korean users. Sapphire Sleet has focused on compromising Rust developers, while Pearl Sleet is known for infecting private GitHub repositories.
Emerald Sleet stands apart, using AI only sparingly and for limited tasks.
Real‑World Examples of AI‑Powered Attacks
During a six‑day window in early June, Jade Sleet simulated a blockchain‑intelligence recruiter. Using AI‑generated profiles, the group set up three fictitious companies with similar infrastructure in just one week, contacting crypto‑industry professionals to gather intelligence.
Similarly, Onyx Sleet’s rapid PDF generation campaign demonstrated how AI can scale phishing operations. In the same period, Coral Sleet and Sapphire Sleet leveraged AI‑assisted coding tools to infiltrate code repositories, planting back‑doors that could later be used to compromise software development environments.
Separate research from security firm Expel highlighted a related trend: groups such as HexagonalRodent have used ChatGPT and the Cursor coding platform to send infected technical test files, compromising thousands of crypto‑wallet credentials.
Economic Impact and Growing Threat
The financial stakes are enormous. TRM Labs reports that 76 % of all cryptocurrency assets stolen in 2026 up to May were traced to North Korean actors, with AI‑assisted scams soaring 500 % year‑over‑year. Chainalysis data shows that North Korean hackers netted more than $2 billion in crypto during 2025 alone, most notably in the Bybit breach.
These AI tools lower the technical barrier for attackers, enabling less‑skilled operators to launch sophisticated campaigns. The result is a surge in social‑engineering scams that rely on deep‑fake profiles, convincing job postings and highly personalized phishing documents.
Why North Korea Turns to AI
North Korea’s cyber‑units have long served as a source of illicit revenue for the regime, targeting financial institutions and cryptocurrency exchanges to fund weapons programs and government operations. The adoption of AI represents the next evolution in this funding model, allowing the state‑backed groups to expand the scale and speed of their operations while keeping human operators in control.
Defensive Response
Security agencies and private firms are scrambling to update detection protocols. Traditional signature‑based defenses are increasingly ineffective against AI‑generated content, prompting a shift toward behavioral analytics, anomaly detection and deeper verification of digital identities.
The Microsoft report underscores a broader trend: cyber‑crime is becoming more automated, but still human‑directed. While AI can draft convincing messages or write code snippets, the strategic decisions behind attacks remain with the operators.
As AI continues to mature, the cybersecurity community warns that the gap between defensive tools and offensive capabilities may widen, making proactive threat hunting and rapid information sharing essential to protecting financial and digital infrastructure worldwide.
Source: fayerwayer.com
