# North Korean Threat Actors Operationalize AI Across Tradecraft (Jade/Coral/Jasper/Diamond/Onyx/Pearl/Sapphire/Emerald Sleet; ProcmacSteal)

> Microsoft reports eight North Korean threat actors using AI for tailored phishing and recruiter lures, fake personas and resumes, target research, malware development and debugging, synthetic voice/video media, and trojanizing private code repositories. The report names the ProcmacSteal malware family (Linux, PowerShell, MacOS, Cargo variants) tied to Sapphire Sleet's August 2026 Rust software supply chain compromise.

- **Published:** 2026-10-29T16:53:13Z
- **Last reviewed:** 2026-10-29T16:53:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4755
- **ID:** TL-2026-4755
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Jade Sleet (North Korea)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Threat Intelligence (2026-10-29) describes a staged adoption of AI by North Korean threat actors. Jade Sleet, Coral Sleet and Jasper Sleet are described as having operationalized AI; Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet as accelerating; and Emerald Sleet as expanding. Motivations span revenue generation for the regime, strategic intelligence collection, and politically motivated disruptive or destructive objectives. Targets include cryptocurrency and financial organizations, IT companies and software supply chains, government, education, oil and gas, and communications/internet policy organizations.

AI is used across the attack lifecycle. For reconnaissance, actors research organizations and employees to craft bespoke lures, and research wallets, exchanges, DeFi, vulnerabilities, APIs and cloud services. For social engineering and identity deception, actors generate tailored phishing and recruiter lures, resumes, biographies and interview answers, enhance or alter profile images, manage multi-platform personas, and (Emerald Sleet) produce synthetic voice and video. Between 2026-06-08 and 2026-06-12 Jade Sleet ran job-themed targeting through three front companies with tailored domains. In August-September 2026 Onyx Sleet generated over 100 target-specific PDF lure files, producing dozens within minutes.

For malware and tooling, actors use AI for code generation, debugging, refactoring, script, command and persistence development, obfuscation and cross-language adaptation. Coral Sleet has operated a GitHub repository trojanization workflow since April 2026. Sapphire Sleet's August 2026 Rust compromise incorporated dynamic .NET compilation for defense evasion and is associated with the Trojan:Linux/ProcmacSteal, Trojan:PowerShell/ProcmacSteal, Trojan:MacOS/ProcmacSteal and Trojan:Cargo/ProcmacSteal detections. Third-party analysis (StepSecurity, Semgrep) of the 2026-08-20 crates.io incident shows compromised arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 pulling the typosquatted proc-macro1 crate, whose build.rs downloaded and detached a platform-specific payload from Hostwinds-hosted infrastructure during cargo build; Semgrep and StepSecurity attribute the infrastructure overlap to Sapphire Sleet campaigns. Microsoft's report does not itself publish IOCs; network and file indicators below come from the third-party Rust incident analyses and the mapping of that incident to the Microsoft-named ProcmacSteal detections is an analyst inference from the shared August 2026 Rust timeframe.

For operational scaling, actors automate repetitive tasks, summarize victim information and accelerate post-compromise decisions. Microsoft reports Onyx Sleet and Pearl Sleet adopting agentic AI via the open-source ARTEX penetration-testing framework from late October 2026, and Cursor (AI IDE) is named as a development platform.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1589 Gather Victim Identity Information
- T1591 Gather Victim Org Information
- T1593 Search Open Websites/Domains
- T1583.001 Acquire Infrastructure: Domains
- T1585.001 Establish Accounts: Social Media Accounts
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1566 Phishing
- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1027 Obfuscated Files or Information
- T1027.004 Obfuscated Files or Information: Compile After Delivery
- T1684.001 Impersonation

## Sources

- [Tracking AI adoption in North Korean threat actor tradecraft](https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/)
- [StepSecurity: arrayref Rust crate supply chain attack](https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack)
- [Semgrep: Rust crates arrayref & append-only-vec compromised via malicious proc-macro1 dependency](https://semgrep.dev/blog/2026/rust-crates-arrayref-append-only-vec-compromised-proc-macro1)
- [SafeDep: arrayref proc-macro1 Rust build-time malware](https://safedep.io/arrayref-proc-macro1-rust-build-time-malware/)
- [Socket: Popular Rust Crates Compromised in Build-Time Supply Chain Attack](https://badge.socket.dev/blog/popular-rust-crates-compromised)
- [Microsoft: Mitigating the axios supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios)
- [CSA research note: Jade Sleet macOS backdoors via Cursor AI](https://labs.cloudsecurityalliance.org/research/csa-research-note-jade-sleet-cursor-backdoor-20260921-csa-st/)
- [GitHub: Security alert - social engineering campaign targets technology industry employees](https://github.blog/security/vulnerability-research/security-alert-social-engineering-campaign-targets-technology-industry-employees/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4755