Search — “Pearl Sleet”
1 story · 0 IoCs
Stories
North Korean threat actors use AI across lures, personas, and tooling, including the ARTEX agentic pentest framework; Microsoft publishes mitigations and Defender detections
Microsoft Threat Intelligence reports that multiple North Korean actors (Jade Sleet, Onyx Sleet, Coral Sleet, Diamond Sleet, Pearl Sleet, Sapphire Sleet, Jasper Sleet, Emerald Sleet) use generative and agentic AI for reconnaissance, persona creation, tailored lures, and tooling. The source says Cursor-type AI development platforms likely helped Coral Sleet, Jade Sleet, Pearl Sleet, and Sapphire Sleet with code and persistence work, and that Onyx Sleet and Pearl Sleet used the open-source ARTEX agentic penetration testing framework. It describes over 100 PDF lures attributed to Onyx Sleet, created in August and September 2026, with dozens generated within minutes. Hunting guidance in the visible text is mitigation-oriented; the post references Microsoft Defender detections without printing specific rules or log patterns.