North Korean hacking groups are adopting artificial intelligence extensively across their operations, with Microsoft’s threat intelligence team rating their overall AI adoption as high. Jade Sleet, Coral Sleet and Jasper Sleet have integrated AI into every stage of their campaigns. Jade Sleet conducted recruitment-themed attacks through three front companies within one week, while Onyx Sleet created more than 100 customized PDF decoy files during August and September. Coral Sleet is suspected of using an AI development platform to plant a Trojan in private GitHub repositories. From late October, Onyx Sleet and Pearl Sleet also began using ARTEX, an open-source agentic AI penetration-testing framework. The campaigns commonly target cryptocurrency and related assets, but Microsoft assessed that people still directed the activity and that the operations had not become fully autonomous.