Three North Korean hacking groups are now using artificial intelligence in their daily operations, according to Microsoft’s report from October 29. The company laid out how these groups use AI for fake job offers, creating fake identities, and developing malicious software.
Meanwhile, blockchain analysts linked a separate theft of $6.36 billion from Binance, the cryptocurrency exchange, to North Korea’s TraderTraitor hacking group. There’s no direct evidence AI played a role in the Binance attack, though.
Microsoft described Jade Sleet, Coral Sleet, and Jasper Sleet as the most advanced when it comes to using AI. These three have fully woven the technology into their routines. Four other groups—Diamond Sleet, Onyx Sleet, Pearl Sleet, and Sapphire Sleet—are adopting AI quickly, while Emerald Sleet is using it, just not as widely.
Still, Microsoft said these North Korean teams aren’t changing their main goals. They’re sticking to old habits: making money for the regime and collecting intelligence.
As for tactics, between June 8 and June 12, Jade Sleet targeted people in cybersecurity, AI, blockchain, and recruitment, pretending to be recruiters for a made-up AI-powered blockchain company. They also ran similar scams using two fake front companies during the same period.
Jasper Sleet uses generative AI to spin up fake online identities and speed up the process of applying for jobs under false pretenses. Coral Sleet, since April, has started adding code from compromised private GitHub repositories to its malware, and Microsoft thinks AI tools probably helped build this capability given how fast it happened.
Onyx Sleet, in August and September, cranked out more than 100 custom PDF lures—dozens of them in just minutes, based on the metadata Microsoft found.
As for the Binance theft, TRM Labs said $6.36 billion moved from Binance wallets across ten blockchains on October 29, most of it in about 20 minutes. Chainalysis reached a similar conclusion, pointing to TraderTraitor. Binance’s own investigation first found a compromised laptop but later uncovered more breach points. So far, Binance said it has frozen about $3 billion in assets with help from its partners and pledged to cover the full losses.
Despite all this AI activity, it’s still humans calling the shots. There’s no suggestion the hacks are fully autonomous. Microsoft also saw Onyx Sleet and Pearl Sleet using ARTEX, an open-source AI tool for penetration testing, since late October.
For those defending against these attackers, Microsoft suggests paying closer attention to suspicious recruiters, tightening phishing defenses, and locking down against malware and exposed systems.
