Microsoft says 3 North Korean hacking groups fully adopt AI

Microsoft ↘ 1.55% says three North Korean state-backed hacking groups now use generative AI in all of their routine attack work. A Microsoft Threat Intelligence report published Oct. 29 names Jade Sleet, Coral Sleet and Jasper Sleet as the groups that have reached its highest stage, called "operationalized." Microsoft rates AI adoption across North Korean threat actors overall as high. The report came out the same day hackers took about $6.3 billion from the cryptocurrency exchange Binance. Blockchain analysts blame that theft on TraderTraitor, a North Korean state hacking unit.microsoft.com+1

How the groups use AI

Microsoft placed eight North Korean groups on a four-stage scale. Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet were rated "accelerating," and Emerald Sleet was rated "expanding." No group remained at the lowest "emerging" stage. The report says Jade Sleet used AI for research and outreach while posing as recruiters for a fake AI blockchain company in June. Since April, Coral Sleet has been planting malicious code in private GitHub repositories, which Microsoft says it very likely built with AI coding tools such as Cursor. Jasper Sleet uses AI to create fake personas and résumés for schemes in which North Korean IT workers get remote jobs under false identities.microsoft.com

Microsoft also found that Onyx Sleet produced more than 100 tailored PDF lures aimed at South Korean users in August and September, sometimes dozens within minutes. Since late October, Onyx Sleet and Pearl Sleet have used ARTEX, an open-source AI tool for penetration testing, in live operations. Microsoft stressed that these operations "remain human-directed and have not become fully autonomous". It also said the effect of AI on attack success rates is still unclear.chosun.com+2

The record Binance theft

TRM Labs said an attacker moved about $6.36 billion out of Binance wallets on 10 blockchains starting at 4:05 p.m. EDT on Oct. 29, most of it within 20 minutes. "TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence," the firm said, adding that it made the judgment "with high confidence". Chainalysis reached the same conclusion and called it the largest theft in crypto history. Binance tied the breach to a compromised DevOps laptop but did not name a culprit. U.S. authorities blamed the same group for the $1.5 billion Bybit theft in February 2025, which was the previous record.upi.com+3

A state built on cyber theft

The Financial Times describes North Korea as a cash-strapped state, cut off by sanctions, that has invested heavily in cyber warfare to help support itself. Microsoft says the groups' goals have not changed: they still aim to raise money for the regime and collect intelligence. AI works as a "force multiplier" that speeds up and scales methods they already use.ft.com+1