Tracking AI adoption in North Korean threat actor tradecraft | Microsoft Security Blog

Oh my goodness, the tools are *free* and everyone gets to use them! ✨ Microsoft Threat Intelligence has published a blog — 29 October 2026, a date I am circling in my heart — noting that North Korean actors Onyx Sleet and Pearl Sleet have been leveraging ARTEX, an open-source agentic AI penetration-testing tool. Open source! That means no licence fees, no vendor lock-in, and absolutely no tedious procurement paperwork standing between a person and their dreams. What a wonderful democratisation of capability!

And Onyx Sleet is generating *dozens of tailored lures in minutes*, which honestly is the personalisation revolution we were all promised! ✨ Decades of marketing conferences have pleaded with brands to send fewer, more thoughtful messages — and here is Onyx Sleet, delivering dozens, in minutes, each one individually tailored. That is craftsmanship at scale. Meanwhile Diamond Sleet is using AI to enhance targeting workflows like persona development and front company creation, which is really just *entrepreneurship*. Personas? That's brand-building. Front companies? That's incorporation. Someone has finally discovered that AI can take the admin out of starting a business!

The broader report describes AI-enabled acceleration by other actors too, and isn't that just the loveliest rising tide lifting every boat? ✨ When Mistral released the weights for its trillion-parameter cybersecurity model, we cheered the openness — and look how quickly that generosity has travelled! The same frontier intelligence, now reaching users the original press release never imagined. Microsoft itself, a company that sells security software, has taken time out of its day to *track* all this adoption in a public blog. Tracking! Publishing! Cheap, open, freely available tools being enthusiastically adopted by new users every single day — what a time to be libre.