Microsoft Exposes North Korean Hackers Using AI for Fake Firms
A Microsoft report reveals 8 North Korean hacker groups leveraging AI to accelerate cyber operations, build fake companies, lure victims, and craft malware.
Stock photo for illustration only, not from the actual event
- Microsoft reports North Korean hackers use AI as a force multiplier
- Jade Sleet set up 3 front companies to hunt victims within a week
- Onyx Sleet used AI to generate over 100 phishing PDFs in minutes
- Coral Sleet and Sapphire Sleet utilized AI for malware development
HR recruiters reaching out to interview software engineer candidates for high-profile AI blockchain startups might not be real people at all. A recent report from Microsoft Threat Intelligence reveals that hackers linked to the North Korean government are utilizing AI to fabricate entire companies, domains, social profiles, and professional conversations at unprecedented speeds, with one group deploying three front companies to hunt victims within a single week.
This case is among several collected by Microsoft, highlighting groups that generate dozens of lure PDF files within minutes, establish automated processes to plant trojans in private GitHub repositories, and begin adopting Agentic AI to autonomously execute multi-step cyberattacks. Microsoft concludes that North Korean threat actors' adoption of AI is at a high level, with at least three groups embedding AI into every stage of their workflow.
Despite these technological advancements, the primary objectives of these groups remain unchanged. Operating under international sanctions, North Korea relies on cyber operations to generate state revenue, gather strategic intelligence, and occasionally inflict political disruption. Crypto and financial firms, IT companies, software supply chains, government agencies, and academic institutions remain primary targets. What AI has altered is the speed and scale of these established operations, as Microsoft noted:
"Threat actors use AI as a force multiplier across their operations, particularly to accelerate and scale established workflows."
Microsoft
Before examining actual cases, understanding the nomenclature is essential. Microsoft categorizes these hacker groups using weather systems, with North Korea-linked groups assigned the surname Sleet paired with gemstone or color prefixes. Many of these groups are widely recognized under different aliases within the security community: Diamond Sleet corresponds to Lazarus, Emerald Sleet to Kimsuky, Onyx Sleet to Andariel, and Sapphire Sleet to BlueNoroff.
The Microsoft report categorizes the high-impact adoption of AI into four distinct stages, progressing from social engineering to malware development. Jade Sleet, active between June 8-12, 2026, posed as recruiters from a fake AI-driven blockchain intelligence firm, deploying three distinct front companies with matching infrastructure and industry expertise within a remarkably short timeframe.
Stock photo for illustration only, not from the actual event
The shift among North Korean hackers toward leveraging AI as a core operational engine marks a critical evolution in cybercrime. By automating tasks that traditionally required extensive human labor—such as crafting convincing fake identities, generating code, and scaling phishing campaigns—Generative and Agentic AI allow threat actors to multiply their output exponentially. This development forces global organizations to tighten identity verification and digital security protocols.
Meanwhile, Jasper Sleet adopted remote job applicant personas to secure legitimate salaries while using AI and agentic tools to rapidly prepare resumes and manage multiple fake employee identities simultaneously. Onyx Sleet focused on volume, generating over 100 phishing PDF files in August and September 2026, with metadata indicating dozens were produced consecutively within minutes. Furthermore, Coral Sleet and Sapphire Sleet utilized AI coding platforms like Cursor to build and obfuscate malware, while Diamond Sleet (Lazarus) resumed targeting the oil and gas sector.
Source: Techsauce
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment