Skip to content
OriginalSign in
Image: Microsoft

MicrosoftMicrosoft Threat Intelligence

Microsoft reports North Korean groups expanding AI operations

Part of the WageMole story · since 16 Oct 2025

Developinglatest 57 minutes ago21 articles9 outlets
16 Oct · GBHackers first23 Apr26 Jun29 AugNowThis article21st of 21
  • Thu 16 Oct, 13:40 UTC. GBHackers, first report. North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks.
  • Fri 17 Oct, 01:45 UTC. SecurityOnline, its first report on the story. North Korea’s Famous Chollima APT Uses Trojanized Node.js App to Deploy OtterCookie RAT for Crypto Theft.
  • Fri 17 Oct, 13:00 UTC. GBHackers. ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware.
  • Mon 20 Oct, 00:55 UTC. SecurityOnline. North Korea’s WaterPlum APT Deploys Node.js OtterCandy RAT for Crypto Theft with Anti-Forensic Module.
  • Wed 21 Jan, 18:30 UTC. The Hacker News, its first report on the story. North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews.
  • Tue 27 Jan, 00:50 UTC. SecurityOnline. “Contagious Interview”: How North Korean Hackers Use Fake Jobs to Breach IT Firms.
  • Mon 23 Mar, 20:21 UTC. The Hacker News. North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware.
  • Tue 21 Apr, 09:51 UTC. trendmicro.com, its first report on the story. Void Dokkaebi Turns Repos Into Worm Like Supply Chain Attack.
  • Wed 22 Apr, 15:08 UTC. Dark Reading, its first report on the story. North Korean Fake Job Scam Triggers Contagious Interview Malware.
  • Wed 29 Apr, 14:21 UTC. Infosecurity, its first report on the story. Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets.
  • Wed 29 Apr, 15:31 UTC. The Hacker News. North Korean Hackers Use Supply Chain npm SDK to Steal Secrets.
  • Mon 15 Jun, 19:50 UTC. The Hacker News. North Korean hackers weaponise developer tools to spread malware.
  • Tue 21 Jul, 09:50 UTC. Infosecurity. North Korean hackers use fake crypto job offers to install RATs.
  • Tue 28 Jul, 07:21 UTC. SecurityOnline. Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers.
  • Mon 7 Sep, 11:26 UTC. Infosecurity. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Tue 22 Sep, 07:47 UTC. Security Affairs, its first report on the story. North Korean Fake Job Interviews Infect 30,000 Devices Worldwide.
  • Tue 22 Sep, 08:59 UTC. SecurityWeek, its first report on the story. North Korean Fake Jobs Infected 30,000 Devices and Stole $10.7m.
  • Tue 22 Sep, 14:31 UTC. Infosecurity. North Korean Hackers Infected 30,000 Devices Through Fake Jobs.
  • Wed 23 Sep, 08:11 UTC. SecurityOnline. North Korean Recruiters Target Developers With Malware in Interviews.
  • Fri 25 Sep, 15:54 UTC. Dark Reading. Nisos Exposes North Korean Fake IT Workers in 170,000 Job Bids.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations. This article, 21st of 21.

Microsoft Threat Intelligence reports that North Korean threat actors are increasing their use of AI across the full spectrum of operations, though adoption levels vary by group. The analysis identifies four stages of AI adoption—emerging, expanding, accelerating, and operationalized—with Jade Sleet, Coral Sleet, and Jasper Sleet described as having operationalized AI across their entire operations.

The report notes that AI serves as a force multiplier to speed and scale existing workflows, rather than enabling fully autonomous actions. Across the actors, AI is applied to research, content generation, development, malware tooling, infrastructure, and broader operational activities, with evidence showing rapid advancement in targeting, social engineering, and tool development.

The piece details concrete examples: Jade Sleet conducting rapid, job-themed targeting in June 2026; Onyx Sleet and Pearl Sleet leveraging the ARTEX open‑source agentic AI framework in late 2026; Diamond Sleet renewing oil, gas, and defense sector focus, and Sapphire Sleet’s automated, AI-assisted Rust malware development.

The report also highlights AI-assisted social engineering—creating tailored lures, fake personas, and synthetic media—alongside AI-enabled software development to refine malware delivery and evasion. It cautions that, despite AI adoption, these operations remain human-directed. Mitigation guidance accompanies the findings, including Defender detections, and tooling such as the Security Dashboard for AI and Agent 365 to govern AI agents and workflows.

Microsoft attributes observations to the North Korean threat actor ecosystem, including Jade Sleet, Coral Sleet, Emerald Sleet, Onyx Sleet, Pearl Sleet, Diamond Sleet, Jasper Sleet, and others, with activity framed as an intensifying but still human‑driven trend.

How the story developed

All 21 articles
Developinglatest 57 minutes ago21 articles9 outlets

21 articles from 9 outlets since 16 Oct. Picked up again today after 5 weeks quiet. This was the 21st report, 378 days after the first.

Now16 Oct18 Jan199281862515321827175First reportGBHackers · 16 Oct, 13:40This article21st of 21 · day 378
  • Thu 16 Oct, 13:40 UTC. GBHackers, first report. North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks.
  • Fri 17 Oct, 01:45 UTC. SecurityOnline, its first report on the story. North Korea’s Famous Chollima APT Uses Trojanized Node.js App to Deploy OtterCookie RAT for Crypto Theft.
  • Fri 17 Oct, 13:00 UTC. GBHackers. ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware.
  • Mon 20 Oct, 00:55 UTC. SecurityOnline. North Korea’s WaterPlum APT Deploys Node.js OtterCandy RAT for Crypto Theft with Anti-Forensic Module.
  • Wed 21 Jan, 18:30 UTC. The Hacker News, its first report on the story. North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews.
  • Tue 27 Jan, 00:50 UTC. SecurityOnline. “Contagious Interview”: How North Korean Hackers Use Fake Jobs to Breach IT Firms.
  • Mon 23 Mar, 20:21 UTC. The Hacker News. North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware.
  • Tue 21 Apr, 09:51 UTC. trendmicro.com, its first report on the story. Void Dokkaebi Turns Repos Into Worm Like Supply Chain Attack.
  • Wed 22 Apr, 15:08 UTC. Dark Reading, its first report on the story. North Korean Fake Job Scam Triggers Contagious Interview Malware.
  • Wed 29 Apr, 14:21 UTC. Infosecurity, its first report on the story. Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets.
  • Wed 29 Apr, 15:31 UTC. The Hacker News. North Korean Hackers Use Supply Chain npm SDK to Steal Secrets.
  • Mon 15 Jun, 19:50 UTC. The Hacker News. North Korean hackers weaponise developer tools to spread malware.
  • Tue 21 Jul, 09:50 UTC. Infosecurity. North Korean hackers use fake crypto job offers to install RATs.
  • Tue 28 Jul, 07:21 UTC. SecurityOnline. Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers.
  • Mon 7 Sep, 11:26 UTC. Infosecurity. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Tue 22 Sep, 07:47 UTC. Security Affairs, its first report on the story. North Korean Fake Job Interviews Infect 30,000 Devices Worldwide.
  • Tue 22 Sep, 08:59 UTC. SecurityWeek, its first report on the story. North Korean Fake Jobs Infected 30,000 Devices and Stole $10.7m.
  • Tue 22 Sep, 14:31 UTC. Infosecurity. North Korean Hackers Infected 30,000 Devices Through Fake Jobs.
  • Wed 23 Sep, 08:11 UTC. SecurityOnline. North Korean Recruiters Target Developers With Malware in Interviews.
  • Fri 25 Sep, 15:54 UTC. Dark Reading. Nisos Exposes North Korean Fake IT Workers in 170,000 Job Bids.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations. This article, 21st of 21.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 21 articles as a list
  1. Thu 16 OctDay 01
    1. North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks13:40 · GBHackers · First report
  2. Fri 17 OctDay 12
    1. North Korea’s Famous Chollima APT Uses Trojanized Node.js App to Deploy OtterCookie RAT for Crypto Theft01:45 · SecurityOnline
    2. ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware13:00 · GBHackers

  3. Quiet for 2 days

    Mon 20 OctDay 41
    1. North Korea’s WaterPlum APT Deploys Node.js OtterCandy RAT for Crypto Theft with Anti-Forensic Module00:55 · SecurityOnline · Picked up again

  4. Quiet for 13 weeks

    Wed 21 JanDay 971
    1. North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews18:30 · The Hacker News · Picked up again

  5. Quiet for 5 days

    Tue 27 JanDay 1031
    1. “Contagious Interview”: How North Korean Hackers Use Fake Jobs to Breach IT Firms00:50 · SecurityOnline · Picked up again

  6. Quiet for 8 weeks

    Mon 23 MarDay 1581
    1. North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware20:21 · The Hacker News · Picked up again

  7. Quiet for 4 weeks

    Tue 21 AprDay 1871
    1. Void Dokkaebi Turns Repos Into Worm Like Supply Chain Attack09:51 · trendmicro.com · Picked up again
  8. Wed 22 AprDay 1881
    1. North Korean Fake Job Scam Triggers Contagious Interview Malware15:08 · Dark Reading

  9. Quiet for 7 days

    Wed 29 AprDay 1952
    1. Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets14:21 · Infosecurity · Picked up again
    2. North Korean Hackers Use Supply Chain npm SDK to Steal Secrets15:31 · The Hacker News

  10. Quiet for 7 weeks

    Mon 15 JunDay 2421
    1. North Korean hackers weaponise developer tools to spread malware19:50 · The Hacker News · Picked up again

  11. Quiet for 5 weeks

    Tue 21 JulDay 2781
    1. North Korean hackers use fake crypto job offers to install RATs09:50 · Infosecurity · Picked up again

  12. Quiet for 7 days

    Tue 28 JulDay 2851
    1. Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers07:21 · SecurityOnline · Picked up again

  13. Quiet for 6 weeks

    Mon 7 SepDay 3261
    1. Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again

  14. Quiet for 2 weeks

    Tue 22 SepDay 3413
    1. North Korean Fake Job Interviews Infect 30,000 Devices Worldwide07:47 · Security Affairs · Picked up again
    2. North Korean Fake Jobs Infected 30,000 Devices and Stole $10.7m08:59 · SecurityWeek
    3. North Korean Hackers Infected 30,000 Devices Through Fake Jobs14:31 · Infosecurity
  15. Wed 23 SepDay 3421
    1. North Korean Recruiters Target Developers With Malware in Interviews08:11 · SecurityOnline

  16. Quiet for 2 days

    Fri 25 SepDay 3441
    1. Nisos Exposes North Korean Fake IT Workers in 170,000 Job Bids15:54 · Dark Reading · Picked up again

  17. Quiet for 5 weeks

    Thu 29 OctDay 3781
    1. Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again · This article, 21st of 21

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in