[CLSTR]
API
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

2 clusters · 16 sources · 1 days · First seen · Last updated

Global cyber espionage and AI integration

Overview

Reports from ESET and Microsoft indicate a rise in global cyber espionage, with nation-aligned groups from China, Russia, Belarus, Iran, and North Korea expanding their operations. These actors frequently target government, defense, and military sectors. Specific activities include Chinese-aligned groups targeting Taiwan’s semiconductor industry and Russian-aligned groups focusing on military objectives in Europe and Ukraine.

A significant trend across these operations is the increasing integration of artificial intelligence and large language models to accelerate tasks such as malware development, phishing, and target research.

North Korean hacking groups, specifically Jade Sleet, Coral Sleet, and Jasper Sleet, have reportedly reached high levels of AI integration. Microsoft threat intelligence reports that these groups have reached the highest stage of AI integration, using it to automate routine operational procedures. Tactics include using generative AI for target research, creating fake identities, and crafting phishing lures, such as generating hundreds of customized PDF phishing documents in minutes. These groups also employ AI coding tools like Cursor for code generation and error correction.

Furthermore, researchers noted the use of the open-source AI penetration testing framework, ARTEX, by groups such as Onyx Sleet. North Korean actors are also expanding into software supply-chain compromises. A group tracked as DeceptiveDevelopment has been observed stealing developer credentials to inject malware into trusted repositories, including npm and PyPI. Additionally, North Korean IT workers have used fake identities to secure remote employment at hundreds of overseas companies, facilitating the theft of sensitive source code and intellectual property.

Entities

ESET · Kaspersky · Hancom · Kim Yeon-soo · Nomadian

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. [TECHNOLOGY] 12 sources
    North Korean hacking groups leverage AI for cyberattacks

    North Korean hacking groups are increasingly integrating AI into their operations to automate phishing, develop malware, and conduct software supply-chain attacks and identity fraud.

  2. [TECHNOLOGY] 4 sources
    ESET report shows rise in global cyber espionage and AI use

    An ESET report on APT activity from April to September 2026 highlights increased cyber espionage by China, Russia, Iran, and North Korea, alongside the growing use of AI in malware development.

Sources

bitmat.it · biz.heraldcorp.com · bjynews.com · byline.network · cybernoz.com · donanimhaber.net.tr · incheonilbo.com · kidd.co.kr · mbn.co.kr · newstomato.com · raillynews.com · tokenpost.kr · trakyaolay.com · uzone.id · world-today-journal.com · zdnet.co.kr

This summary has been updated 1 time: see revision history