Tracking AI adoption in North Korean threat actor tradecraft | Microsoft Security Blog

Microsoft Threat Intelligence, in a post published on the Microsoft Security Blog at microsoft.com and dated 29 October 2026, states that since late October 2026 it has identified North Korean actors Onyx Sleet and Pearl Sleet leveraging the open-source agentic AI penetration-testing tool ARTEX in operations. The post identifies both actors by name and attributes the tool use to them. ARTEX is described as an open-source agentic AI penetration-testing tool.

The post states that Onyx Sleet has used AI to generate dozens of tailored lures in minutes. It also states that Diamond Sleet, another actor named in the post, has used AI to enhance targeting workflows, citing persona development and front company creation as examples. The blog further describes AI-enabled acceleration by other actors beyond those named in the ARTEX discussion.

It frames the activity as adoption of AI by North Korean threat actors, describing the observations as identified since late October 2026 and characterising them as AI-enabled acceleration. Microsoft Threat Intelligence is the Microsoft unit publishing the findings. The excerpt provided does not specify the evidence behind the attribution of ARTEX use to the named actors, the number of incidents involved, or any mitigations the post recommends.