Microsoft reports North Korean actors Onyx Sleet and Pearl Sleet adopted ARTEX in human-directed operations

Key facts

As stated in the sources, with where to find them.

• Microsoft separates actor-specific stages of AI adoption and places Onyx Sleet and Pearl Sleet in its accelerating category. Its stage labels are intelligence assessments, not measured autonomy levels.Stages of AI adoption by North Korean threat actors
• The report includes inference from lure metadata and operational pace as well as identified tooling. Such indicators do not independently establish agent execution in every described activity.AI-assisted targeting and reconnaissance; AI-assisted social engineering and identity deception
• Microsoft describes agentic tooling as support for existing goals and operator decisions; it does not supply a representative success rate or a count of ARTEX-caused compromises.AI use across North Korean threat operations; AI-assisted operational scaling and analysis

Findings that cite this record

Key questions this bears on

• How are attackers using AI agents in real operations?To run parts of intrusions at scale: vendors report a state-aligned actor and criminal groups using open-source agent frameworks and commercial models.

Sources

• Tracking AI adoption in North Korean threat actor tradecraftMicrosoftOct 29, 2026Primary sourceAccessed Oct 30, 2026

Related records