Tracking AI adoption in North Korean threat actor tradecraft | Microsoft Security Blog

Microsoft Threat Intelligence has published a blog dated 29 October 2026 reporting that North Korean actors Onyx Sleet and Pearl Sleet have been leveraging ARTEX — an open-source, agentic AI penetration-testing tool — in their operations. So the agentic revolution has finally found its most enthusiastic enterprise customer: a sanctions-evading state programme with a payroll and a procurement process that consists of typing 'git clone'. The blog notes Onyx Sleet now generates dozens of tailored lures in minutes. Dozens. In minutes. Your average marketing department needs a two-week sprint and a brand workshop to agree on three subject lines.

And then there is Diamond Sleet, using AI to enhance targeting workflows — persona development, front company creation. Read that again and appreciate the ambition: the tedious administrative drudgery of espionage, outsourced to a model. Every keynote you have ever sat through about agents 'removing toil from knowledge work' should now be re-read with the understanding that the toil being removed is a man in a shell company trying to keep his fake backstory consistent across four time zones. ARTEX is open source, incidentally. Free at the point of use, like all the very best things in life.

When Mistral released the weights of a trillion-parameter model and pitched it as frontier intelligence for cyber defenders, we noted the direction of travel. Here is the other end of it: the defenders' tooling is open, so the attackers simply use the defenders' tooling. Microsoft, meanwhile, is a company that sells security products publishing a blog explaining that security is getting harder — which is either admirable transparency or the most efficient content-marketing funnel ever built, and possibly both. The headline says 'tracking AI adoption'. Tracking. Someone is watching this happen with a spreadsheet.