Microsoft links ARTEX use to two North Korean activity clusters

Microsoft Threat Intelligence's October 29 account links ARTEX-assisted offensive workflows to Onyx Sleet and Pearl Sleet. The significant development is how a model-enabled framework enters an already operator-controlled intrusion chain, not a demonstration that an AI system independently picked targets and initiated a campaign.

The available reporting distinguishes reconnaissance, generated commands and executed effects. A tool may draft a script that never runs, or a human operator may select and execute only part of the output. Without complete transcripts and host telemetry, the number of model-generated ideas cannot be equated to successful intrusions. The Microsoft report provides the attribution claim; the canonical ARTEX dossier identifies what is reported and what remains unproven.

CrowdStrike's separate VAPOR PANDA investigation also involves ARTEX but has a different reporting population and incident evidence. Reusing one framework is not enough to attribute two campaigns to one actor. An evidence-led comparison would require overlapping operator infrastructure, timestamps, malware, or verified access activity, not merely the same tool name.