Circumstances have been detected indicating that a North Korean hacking organization mass-produced phishing documents (documents designed to steal personal information or induce malware infections) targeting South Korean users by leveraging artificial intelligence (AI). Following a confirmed case in July last year where malicious emails containing AI-generated images were sent under the guise of a South Korean military-related institution, this time the group reportedly used AI to create dozens of customized phishing documents per target within minutes. However, it remains unconfirmed whether the newly produced phishing documents targeting South Korea were actually distributed or caused any damage.
According to a report published by Microsoft on the 29th (local time), the North Korean hacking group "Onyx Sleet" (domestic name Andariel) produced over 100 customized PDF lure documents for South Korean users between August and September this year. Microsoft analyzed metadata, including the creation timestamps of the PDF files, and discovered traces of dozens of documents being generated within minutes. Based on this, they concluded it was highly likely that an AI platform was used. Microsoft did not disclose how the files were obtained.
◇Beyond Phishing Documents: Attacks on Corporate Source Code
Microsoft also analyzed the AI adoption levels of eight other North Korean hacking groups. Among them, three groups—Jade Sleet, Coral Sleet, and Jasper Sleet—were assessed to have reached the highest level of "operational maturity," where AI is fully integrated into daily attack operations. The remaining four groups were categorized as being in the "acceleration" phase, where AI utilization is rapidly expanding, and one group was in the "expansion" phase, where AI is applied to specific tasks.
The analysis revealed that North Korean groups have extended their AI use beyond phishing document creation to developing techniques for attacking corporate software. According to the Microsoft report, the North Korean hacking group "Coral Sleet" introduced an attack procedure in April this year, embedding malicious code into source code in private GitHub repositories of companies. Microsoft assessed that the rapid development and widespread use of this capability strongly suggest the use of AI-based development tools. However, the targeted companies and the scale of damage were not disclosed.
Another hacking group, "Sapphire Sleet," was estimated to have improved malware functionality using AI in an attack targeting software developers in August. Microsoft analyzed in the report, "North Korean hacking groups are using AI to enhance the speed and efficiency of existing attacks. However, the setting of attack objectives and major decision-making processes are still led by humans."
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
