North Korean actors operationalize AI to scale financial fraud

1. Executive summary

Microsoft reports that North Korean operators are using generative and agentic AI to accelerate reconnaissance, job-themed social engineering, fraudulent worker activity, malware development and software supply-chain attacks. Financial and cryptocurrency organisations are established targets, although Microsoft identifies no affected EMEA financial institution in this report. The principal risk is higher-volume, better-tailored fraud and intrusion activity, including rapid lure generation, false recruiter and employee personas, trojanized source repositories and faster post-compromise decisions. No CVE has been assigned, so CVSS severity and CISA KEV status do not apply. The actor attribution is single-sourced, and the cited Sleet labels are not mapped to MITRE ATT&CK group profiles, so attribution remains unconfirmed.

2. Regulatory framing

3. Technical analysis & attack chain

Microsoft assesses that AI is accelerating existing North Korean tradecraft rather than producing autonomous attacks. Human operators retain control of objectives and decisions. AI use spans target research, lure and persona creation, malware development, infrastructure support, collected-data summarisation and post-compromise decision support.

Between 8 and 12 June 2026, Jade Sleet used job-themed outreach against individuals at cybersecurity, AI, blockchain and recruitment companies. The campaign used tailored domains, social media profiles and industry knowledge to present software engineering opportunities from a spoofed AI-powered blockchain intelligence company. Engaged targets were directed towards interviews. Microsoft linked comparable activity to two further front companies during the same week, indicating that the operator could prepare several tailored campaign identities in parallel.

Jasper Sleet used suspected generative and agentic AI-assisted résumé workflows to support fraudulent remote-worker identities. Microsoft observed application activity consistent with repeatable tooling intended to increase the volume and relevance of applications. The same tooling reportedly helped operators maintain consistent communications and work performance across multiple false personas.

Onyx Sleet produced more than 100 target-specific PDF lures during August and September 2026. File metadata showed dozens of documents being created within minutes. Microsoft assesses this activity as highly likely to be AI-generated and associates it with high-volume phishing against South Korean users. No filenames, hashes, delivery domains or document contents are supplied.

Emerald Sleet may have tested AI-generated voice or video for social engineering. Microsoft could not determine the operational effect of this activity. The synthetic-media assessment is therefore less certain than the observed PDF-generation and application-workflow activity.

AI-assisted development is also present in software and malware operations. Microsoft links use of development platforms such as Cursor to Jade, Coral, Pearl and Sapphire Sleet, but does not provide code-level artefacts or identify the generated functions. In an August 2026 operation targeting Rust developers, Sapphire Sleet deployed malware that used dynamic .NET compilation after compromise, most likely for defence evasion. Microsoft Defender identifies related detections as Trojan:Linux/ProcmacSteal, Trojan:PowerShell/ProcmacSteal, Trojan:MacOS/ProcmacSteal and Trojan:Cargo/ProcmacSteal.

Since April 2026, Coral Sleet has reportedly used a workflow that trojanizes private GitHub repositories and incorporates the modified repositories into an existing malware chain. Microsoft describes the breadth and speed of implementation as highly likely to have involved an AI-enabled development platform. The report does not identify affected repositories, packages, GitHub organisations, commits, access tokens or build systems.

Since late October 2026, Onyx Sleet and Pearl Sleet have used the open-source ARTEX agentic AI penetration-testing framework in operations. The report does not state which ARTEX functions were used, which targets were assessed or whether the framework produced initial access.

No initial-access CVE, affected product version, port, protocol, command line, persistence method, privilege-escalation path, command-and-control endpoint, lateral-movement mechanism or exfiltration route is provided. No CVE has been assigned, so CVSS severity and CISA KEV status do not apply. Microsoft does not report a completed fraud loss or confirmed compromise of an EMEA financial institution.

The operational detail and attribution are single-sourced; verify before enforcement. Microsoft’s Sleet labels in this report are not mapped to MITRE ATT&CK group profiles, so attribution to specific North Korean groups remains unconfirmed.

4. Mitigation & containment

No vendor patch or fixed version applies to this campaign-level activity. Remediation depends on identity containment, recruitment controls, source-repository protection and detection of related behaviour.

P1, within 24 hours

• Confirm that Microsoft Defender is ingesting and escalating the actor-specific, reconnaissance, identity, email and ProcmacSteal detections named in section 6.
• Hunt email, web, collaboration and recruitment records for job or partnership approaches that use software engineering roles, AI or blockchain themes, unfamiliar recruiter domains, attached PDFs and rapid movement towards an interview.
• Review PDF metadata for batches of target-specific documents created within minutes. Quarantine associated messages and preserve the original files and headers for analysis.
• Investigate Entra alerts for atypical travel, impossible travel and sign-ins associated with suspected Jasper Sleet activity. Disable confirmed fraudulent accounts, revoke active sessions and isolate affected endpoints.
• Suspend access for any worker identity that cannot complete independent identity and employment verification. Preserve application, interview, authentication and device-registration records before removal.

P2, within 72 hours

• Review private GitHub audit logs and repository changes from April 2026 onwards for unexpected collaborators, application installations, token use, branch-protection changes and unauthorised commits. Revoke suspect credentials and rebuild affected artefacts from a verified source state.
• Check whether Rust development or build environments accepted external code, packages or developer contributions during August 2026. Preserve source, dependency, build and deployment records where exposure cannot be excluded.
• Require independent verification of recruiter and prospective-employer domains before staff open interview files, run supplied code or install assessment software.
• Require approval for GitHub application installation, protect release branches and restrict CI secrets so that a repository write does not automatically provide production access.
• Search endpoint telemetry for unexpected dynamic .NET compilation following activity in Rust development or build environments. Isolate the device if the compilation cannot be tied to authorised development.

P3, within 7 days

• Add live identity checks and independently sourced callback procedures to remote hiring. Do not rely on résumés, video calls or supplied contact details as sole proof of identity.
• Issue managed devices to remote workers and delay access to source code, payment systems, customer data and production secrets until identity and employment checks are complete.
• Test alert routing for high-volume PDF creation, unusual job-themed attachments, private-repository control changes and the Defender detections listed below.
• Review supplier assurance requirements for repository protection, build provenance and notification of unauthorised source changes.

5. Indicators of compromise

No indicators of compromise available in the source material.

The behaviours below are single-sourced; verify before enforcement.

Behavioural indicators

6. Detection

Microsoft provides Defender alert titles and malware detection names, but no malicious-file strings, paths, mutexes or command lines suitable for YARA. The following Sigma rule routes the exact Defender alert titles identified by Microsoft. It does not independently validate the attribution.

title: Microsoft Defender alerts cited for North Korean AI-enabled operations
status: experimental
description: Detects Microsoft Defender alert titles cited in reporting on AI-assisted North Korean operations.
author: Adverse Trace
date: 2026-10-29
references:

  - https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/
logsource:
  product: microsoft_365_defender
  service: alertinfo
detection:
  selection_actor:
    Title:

      - 'Emerald Sleet threat actor activity'
      - 'Diamond Sleet Actor activity detected'
      - 'Onyx Sleet activity group'
      - 'Pearl Sleet actor activity detected'
      - 'Sapphire Sleet actor activity'
      - 'Jade Sleet threat actor activity detected'
      - 'Coral Sleet activity'
      - 'Sign-in activity by a suspected North Korean entity Jasper Sleet'
  selection_reconnaissance:
    Title:

      - 'Possible AI Tools Reconnaissance Detected'
      - 'Possible Secret Reconnaissance Detected'
  condition: selection_actor or selection_reconnaissance
falsepositives:

  - Vendor-generated alert titles require validation against the associated endpoint, identity, email and application evidence.
level: medium

Defender Antivirus coverage should also be checked for these exact detections:

• Trojan:Linux/ProcmacSteal
• Trojan:PowerShell/ProcmacSteal
• Trojan:MacOS/ProcmacSteal
• Trojan:Cargo/ProcmacSteal

Threat actor context

Andariel · G0138 · aka Silent Chollima, PLUTONIUM, Onyx Sleet

Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. …

Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

APT38 · G0082 · aka NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. …

Kimsuky · G0094 · aka Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. …

No MITRE ATT&CK profile for: Jade Sleet, Coral Sleet, Pearl Sleet, Jasper Sleet.

7. Sources

• Microsoft Threat Intelligence, “Tracking AI adoption in North Korean threat actor tradecraft”, https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/, 29 October 2026.

8. Adverse Trace position

We assess this as a strategic fraud and intrusion advisory without an assigned CVSS severity because no CVE or discrete vulnerability is reported; CISA KEV status does not apply. EMEA financial services exposure is credible because financial and cryptocurrency organisations are named target sectors, but Microsoft identifies no affected EMEA institution, financial loss or confirmed intrusion in this report. The actor labels and operational claims are single-sourced; verify before enforcement, and treat attribution as unconfirmed because the cited Sleet labels are not mapped to MITRE ATT&CK group profiles. We will monitor for independent corroboration, affected repositories or packages, atomic indicators and code-level artefacts. Clients should first review recruitment identities, private-repository audit records and the named Defender alerts.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.