Microsoft’s threat intelligence team published an October 29 follow-up report, “Tracking AI adoption in North Korean threat actor tradecraft,” assessing that Jasper Sleet has embedded AI across its operations, using generative and agentic tools to research software roles, extract job requirements, tailor fraudulent resumes and personas, support coding assessments, and manage multiple worker identities. The report says North Korean threat actors alter profile images, video, voice, and backgrounds to make social engineering more convincing. Microsoft’s March 6 report, “AI as tradecraft: How threat actors operationalize AI,” rated eight North Korean-linked groups; Jade Sleet, Coral Sleet and Jasper Sleet were rated as having operationalized AI across their workflows, while Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet were rated as accelerating. The October update kept those groups in the same stages and rated Emerald Sleet as expanding its use of AI. Coral Sleet uses AI coding tools to generate, refine, and reimplement malware components, and Microsoft says it has used agentic tools in a workflow spanning fake company websites, remote infrastructure provisioning, and payload testing and deployment. Microsoft assesses that these AI-enabled operations remain directed by human operators. The U.S. Justice Department has said North Korea’s government withholds up to 90% of overseas workers’ wages and that its IT workers collectively generate hundreds of millions of dollars a year for entities involved in the country’s weapons programs.