Microsoft finds 2 North Korean groups using ARTEX, a tool that alone cannot name an attacker

Editor’s Note: Microsoft Threat Intelligence said Oct. 29, 2026, that since late October it has identified two North Korean hacking groups, Onyx Sleet and Pearl Sleet, using ARTEX. ARTEX is an artificial intelligence penetration testing framework built in China and first released publicly on GitHub, and between Oct. 7 and Oct. 29, reports from CrowdStrike, Zscaler and Microsoft also tied it to a likely Chinese-speaking, financially motivated actor and two China-linked operations. Microsoft rated North Korean groups’ overall AI adoption as high and assessed that their AI-enabled operations remain human-directed and have not become fully autonomous. It defined four adoption stages but did not disclose how it scores groups against them or which organizations the North Korean ARTEX activity reached.

For cybersecurity, information governance and eDiscovery professionals, an ARTEX match alone cannot identify the attacker, Zscaler’s research shows legal settlement systems among one ARTEX operator’s targets, and North Korean fake-worker schemes put hiring and onboarding records into the evidence that investigations and litigation holds may need to reach.

Watch for detections that do not depend on naming the actor, further vendor reporting on North Korean ARTEX use and any disclosure of affected organizations.

News Analysis – Cybersecurity Beat

Microsoft finds 2 North Korean groups using ARTEX, a tool that alone cannot name an attacker

ComplexDiscovery Staff

Microsoft said Oct. 29 that since late October it has identified two North Korean hacking groups using ARTEX, an artificial intelligence penetration testing framework tied to China-linked intrusions, and that their AI-enabled operations remain human-directed.

The finding adds two more names to a list that shows why an ARTEX sighting alone cannot identify an attacker. Between Oct. 7 and Oct. 29, reports from CrowdStrike, Zscaler and Microsoft tied the framework to a likely Chinese-speaking, financially motivated actor, two China-linked operations and now Onyx Sleet and Pearl Sleet.

What Microsoft says North Korea’s groups now do with AI

The ARTEX finding sits inside a broader assessment by Microsoft Threat Intelligence. Microsoft rated North Korean actors’ overall AI adoption as high and placed eight groups it calls high-impact in a four-stage model: emerging, expanding, accelerating and operationalized. Jade Sleet, Coral Sleet and Jasper Sleet sit at the operationalized stage, which Microsoft defines as AI embedded in routine operational workflows. Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet are accelerating, Emerald Sleet is expanding, and Microsoft said it has assessed no North Korean actor at the emerging stage.

Dated particulars carry the report. Onyx Sleet produced over 100 PDF lure files with target-specific details in August and September 2026. File metadata showed dozens created within minutes, which Microsoft said was “highly likely to be the output of an AI platform.” Those lures supported high-volume phishing against South Korean users. Between June 8 and June 12, Jade Sleet posed as recruiters for what Microsoft called “a spoofed AI-powered blockchain intelligence company” and ran similar job-themed outreach through two more front companies in the same window.

Coral Sleet has run a workflow since April 2026 that trojanizes private GitHub repositories, a capability Microsoft said was highly likely built with an AI-enabled development platform. Sapphire Sleet likely used AI during the August 2026 Rust software compromise, which began with targeting of Rust developers, according to the post. Its malware in that campaign used dynamic .NET compilation, most likely to evade defenses. Microsoft said AI-assisted development platforms, Cursor among them, likely helped Jade Sleet, Coral Sleet, Pearl Sleet and Sapphire Sleet generate, convert and debug code.

4 stages defined, but no scoring disclosed

Those examples are specific and checkable, but the ratings built on them are harder to test. Microsoft defines each stage in a sentence or two, from limited or experimental use at the emerging stage to AI embedded in routine workflows at the operationalized stage. It does not say how many North Korean actors it assessed before naming the eight high-impact groups, what evidence places a group in one stage rather than the next, or how many AI-enabled operations it counted. The company attributes part of its reconnaissance findings to industry reporting and to shifts in 2026 targeting.

The post also names no large language model, and apart from ARTEX itself, the only AI product it ties to the actors’ activity is Cursor. CrowdStrike, by contrast, said DeepSeek v4.1-flash served as the primary model behind the ARTEX instance in the South Korean finance campaign it reported Oct. 7, and it named two other models the actor used alongside it. Zscaler examined that operator’s wider environment in an Oct. 21 report, including the server CrowdStrike identified as hosting ARTEX. It cautioned that configuration files show the model an operator requested, not the one a gateway actually served, and said some sessions may have used Anthropic’s Claude models.

Why an ARTEX sighting alone cannot identify its operator

The three companies whose research anchors this account, Microsoft, CrowdStrike and Zscaler, each sell the defenses their reports recommend. Their reports also trace the framework’s history, which explains why a sighting proves little about who is behind it. CrowdStrike described ARTEX as a new open-source tool built in China. Zscaler ThreatLabz researchers Rohit Hegde and Jithin Prajeev Nair wrote Oct. 14 that a developer using the handle Autumn-27 originally released it on GitHub. After the South Korean financial-sector intrusions became public, the developer said Oct. 8 that the project would go closed source, Reuters reported, and Zscaler said copies downloaded before the change, along with forks, may still be available.

Use continued after the announcement. Microsoft said Oct. 21 that Storm-0940, a China-state aligned actor, had used ARTEX since as early as September 2026, and it assessed that the group was responsible for the ConnectWise Cloud Backup supply chain compromise, which ComplexDiscovery examined Oct. 22. CrowdStrike reported Oct. 29 that a group it tracks as VAPOR PANDA used ARTEX against over 200 organizations beginning Oct. 17, in a campaign CrowdStrike said was separate from the Storm-0940 activity. Microsoft says it has identified North Korean use since late October, weeks after the developer’s announcement.

Law firms and legal service providers have reason to read that record closely. Microsoft listed legal among the industries Storm-0940 targeted with ARTEX, without saying whether any law firm was compromised. Zscaler’s Oct. 21 report found prompts from the South Korean campaign’s operator aimed at legal settlement systems, and for a legal claims administration target, they sought claim-workflow analysis and asked the AI to “assess opportunities for additional access.”

The spread of users is the operational lesson for incident responders. In the article’s analysis, a playbook that maps ARTEX artifacts to one adversary and its usual objectives would misread the North Korean cases. Microsoft describes those groups as generating revenue for the regime, collecting intelligence and, for some operations, pursuing disruptive or destructive aims. Microsoft’s Oct. 21 post had already said it saw actors in several regions of the world using the framework, eight days before it placed two North Korean groups among them.

Hunting the framework instead of the flag

If the tool alone cannot name the actor, defenders need detection that does not depend on naming one. Public hunting guidance for that remains limited, though vendors report coverage inside their own products. Zscaler said its platform detects indicators tied to the operator it examined under the threat name AI.HackTool.ARTEX. CrowdStrike’s VAPOR PANDA report lists ARTEX markers to hunt for: command-line parameters containing “artx” or “artex” strings, artx-prefixed cloud roles, art18- comments on administration commands and a C:\ProgramData\artx5v\ directory. CrowdStrike drew those markers from one adversary’s deployment, and the report does not say whether other operators’ installations leave the same traces.

Zscaler’s behavioral indicators reach further but prove less on their own. They include unexpected outbound calls to commercial model services, among them api.deepseek.com and api.anthropic.com, and high-frequency automated requests that enumerate login and search endpoints in sequence. Zscaler presents them as potential indicators to weigh together with other signs of suspicious activity, not as proof of ARTEX use.

Microsoft’s detections key on behavior and on actor names. Its Oct. 21 table includes an alert for an application assigning itself the Global Administrator role, and its Oct. 29 table lists alerts by actor name plus a generic alert for possible AI tools reconnaissance. Neither post’s detection tables include an entry named for ARTEX. The Oct. 29 post mentions the framework twice and does not say which organizations the North Korean ARTEX activity reached or what it accomplished.

Human hands still on the controls

What the post does say about who runs these operations is its most consequential finding, though it sits in the opening section rather than among the findings on lures and code. “Microsoft Threat Intelligence assesses that AI-enabled operations remain human-directed and have not become fully autonomous,” the post said. Elsewhere it said “human operators likely continue to direct intent and objectives” while AI summarizes information collected from victim organizations and speeds post-compromise decisions.

CrowdStrike’s evidence points the same way from a different operation. “The framework kept a human in the loop,” the VAPOR PANDA report said. It cited recovered transcripts in which an operator gave orders in Chinese, tagged with a label CrowdStrike translated as “human instruction,” and told the agents to write web shells and pull domain administrator passwords. The operator stepped in only at decision points while ARTEX ran several engagements at once. Those observations sit beside Microsoft’s Oct. 21 description of ARTEX as agents that “run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction.” The capability and the observed use fit together, because the framework can run with little supervision while, in the operations examined, operators still steered it.

Zscaler’s Oct. 21 report adds a qualification. The operator it examined still directed the work, but told the AI to treat every supplied target as preauthorized, and some application settings allowed autonomous actions without the operator’s approval for each step.

Readers in legal technology will recognize the shape of these findings. The debate over whether AI can run document review without human oversight has a mirror on the attacker side, and for the operations each examined, Microsoft and CrowdStrike describe human direction as still in place. The agents take over much of the work between decisions, which shrinks the time defenders have to respond; Microsoft said some Storm-0940 attacks went from first targeting to privileged cloud access in under three hours.

Fake workers and the records they leave behind

Jasper Sleet shows where that division of labor reaches information governance teams. Microsoft said the group uses fake identities to land genuine remote jobs and that its AI tooling helps keep communication and performance consistent across several fake worker personas. The Treasury Department on Oct. 28 sanctioned 10 individuals and one entity tied to North Korean information technology worker schemes. Its release described those schemes as relying on fraudulent documents, stolen identities and fabricated personas.

When a hire turns out to be a persona, the evidence sits in human resources and onboarding systems as much as in security logs: applications, background-check results, interview recordings, identity verification records and device assignments. In the article’s analysis, organizations that may need to place those records under a litigation hold should identify the hiring and onboarding custodians and systems in advance, since recruiting platforms and video tools may apply retention settings of their own.

Microsoft’s vetting guidance doubles as a list of records worth keeping. It recommends checking whether a candidate’s professional accounts closely resemble other people’s accounts and whether the contact phone number on those accounts also appears on other accounts. It also advises contacting references by phone or video rather than email alone, confirming that the candidate appears on camera across multiple sessions and searching whether the same persona works at several companies. The camera test may not settle the question, since Microsoft also identified voice and video that Emerald Sleet possibly generated with AI, though it said it has not been able to measure the tooling’s full operational effect.

Read together, the reports from CrowdStrike, Zscaler and Microsoft leave ARTEX as one data point among several, a tool whose presence alone says little about who is using it. Behind the agents, Microsoft and CrowdStrike both found a person still directing the work. If the attackers studied here still keep people in charge of their operations, what evidence could your organization produce to show that its own human review, in security response and in eDiscovery, is still doing its work?

News Sources

• Tracking AI adoption in North Korean threat actor tradecraft (Microsoft)
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Microsoft)
• Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses (U.S. Department of the Treasury)
• North Korea Designations; Democratic Republic of the Congo-related Designations (Office of Foreign Assets Control)
• VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign (CrowdStrike)
• Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance (CrowdStrike)
• Inside a Global AI-Assisted Hacking Campaign (Zscaler)
• Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions (Zscaler)
• ARTEX and Friends: Enter Agentic Offensive Frameworks (Google Threat Intelligence Group and Mandiant)
• Chinese developer makes ARTEX AI agent closed-source after Korean bank hack (Reuters via WHBL)
• After the ConnectWise breach, a firm’s GDPR clock may start before its Microsoft 365 logs can answer (ComplexDiscovery OÜ)

Assisted by GAI and LLM Technologies

Additional reading

• With over 40 percent of the record Binance theft frozen, getting it back becomes a legal project
• Estonia’s cyber authority saw no state-sector PHP crisis as three state institutions shut or restricted services
• AI recording spreads in Estonian health care as the regulator says the audio needs its own legal basis

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.