Evidence · DiggingBeagle record
Microsoft Threat Intelligence: AI use across North Korean threat actor tradecraft
Microsoft analysis of distinct North Korean activity clusters, tool adoption, counterfeit recruiting, and limitations of observed AI involvement.
- Published
- Oct 29, 2026
- Source role
- primary disclosure
Evidence record
Microsoft analysis of distinct North Korean activity clusters, tool adoption, counterfeit recruiting, and limitations of observed AI involvement.
Claim-level citations (2)
- supportsNorth Korean threat actors used generated recruiting content alongside other intrusion lures: Microsoft reported AI-themed recruiting fronts and large-scale generated phishing or application materials in several North Korean actor campaigns without proving each contact was successful.
Microsoft October 29 report, Jade Sleet fronts, Onyx Sleet document production and fake worker schemes
- supportsMicrosoft linked ARTEX agentic tooling to Onyx Sleet and Pearl Sleet activity: Microsoft associated ARTEX agentic offensive framework use with North Korean activity clusters Onyx Sleet and Pearl Sleet; the available report does not establish autonomous model-initiated campaigns.
Microsoft October 29 threat actor tradecraft report, Onyx/Pearl Sleet and ARTEX sections