Observed incident

Microsoft details AI-assisted North Korean operations and ARTEX adoption

Reported

Published here

What happened

Microsoft reports Onyx Sleet and Pearl Sleet using ARTEX in late October, alongside AI-assisted recruitment lures, fake personas and tooling across other North Korean clusters.

Parties and reporting

AI tools and systems: ARTEX, Cursor (assessed use), Unspecified generative AI platforms

Outcome

Microsoft published defensive guidance and detections. Campaign-wide containment, victim totals and losses are not disclosed; it assesses the operations remain human-directed.

Operating lesson

Verify recruitment identities, isolate untrusted interview code and correlate credential abuse, repository changes and rapid multi-step activity.

Evidence and limits

A grouped threat-activity report, not a count of new victims. Activity spans April–October; attribution and inferred AI-generated content remain Microsoft assessments. No equivalence with PRC-linked ARTEX campaigns is inferred.

Sources