{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/microsoft-north-korean-artex-adoption-2026/",
 "asOf": "2026-10-30",
 "id": "microsoft-north-korean-artex-adoption-2026",
 "date": "2026-10-29",
 "datePrecision": "day",
 "title": "Microsoft reports North Korean actors Onyx Sleet and Pearl Sleet adopted ARTEX in human-directed operations",
 "lane": "attack",
 "kind": "misuse-report",
 "summary": "Microsoft Threat Intelligence reports that Onyx Sleet and Pearl Sleet used ARTEX in operations from late October 2026. Its broader assessment describes North Korean actors using AI to accelerate established targeting, social engineering and tooling workflows, while explicitly judging the operations human-directed rather than fully autonomous.",
 "whyItMatters": "It extends reported agent-framework adoption across threat actor groups without conflating general AI assistance with autonomous intrusion.",
 "actors": [
  "microsoft",
  "onyx-sleet",
  "pearl-sleet"
 ],
 "topics": [
  "ai-enabled-intrusion",
  "autonomous-pentest",
  "fraud-and-social-engineering",
  "threat-intelligence"
 ],
 "atlas": [
  "tools",
  "other-agents"
 ],
 "artifacts": [
  "artex"
 ],
 "sources": [
  {
   "url": "https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/",
   "publisher": "Microsoft",
   "title": "Tracking AI adoption in North Korean threat actor tradecraft",
   "date": "2026-10-29",
   "type": "primary",
   "accessed": "2026-10-30"
  }
 ],
 "keyFacts": [
  {
   "fact": "Microsoft separates actor-specific stages of AI adoption and places Onyx Sleet and Pearl Sleet in its accelerating category. Its stage labels are intelligence assessments, not measured autonomy levels.",
   "locator": "Stages of AI adoption by North Korean threat actors"
  },
  {
   "fact": "The report includes inference from lure metadata and operational pace as well as identified tooling. Such indicators do not independently establish agent execution in every described activity.",
   "locator": "AI-assisted targeting and reconnaissance; AI-assisted social engineering and identity deception"
  },
  {
   "fact": "Microsoft describes agentic tooling as support for existing goals and operator decisions; it does not supply a representative success rate or a count of ARTEX-caused compromises.",
   "locator": "AI use across North Korean threat operations; AI-assisted operational scaling and analysis"
  }
 ],
 "significance": 4,
 "fideQuestions": [],
 "methods": [
  "agent-orchestrated-intrusion"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-30",
 "revisions": []
}