Microsoft publishes first staged assessment of AI adoption across eight North Korean threat groups (incl. ARTEX use)

On Oct 29, Microsoft Threat Intelligence assessed AI adoption across eight North Korean groups by maturity stage (operationalized: Jade Sleet, Coral Sleet, Jasper Sleet; accelerating: Diamond Sleet, Onyx Sleet, Pearl Sleet, Sapphire Sleet; expanding: Emerald Sleet). Onyx Sleet and Pearl Sleet are now using the open-source ARTEX agentic pentest framework, and the report includes Microsoft Defender detections and mitigation guidance.

It is the most detailed vendor mapping of how a state actor is industrializing AI for reconnaissance, tailored social engineering and tooling, and ties adversary AI use to concrete Defender detections security teams can act on.

Defenders and threat-intel teams should align detection content and hunt rules to the AI-assisted tactics (targeted lures, persona/front-company creation, ARTEX-based ops) and review the published Defender detections for coverage gaps.