# Global cyber espionage and AI integration

> Developing situation record from CLSTR: https://clstr.news/situations/global-cyber-espionage-and-ai-integration
> Updated: 2026-10-29T02:26:27.000Z. Sources: 16. Developments: 2.

Reports from ESET and Microsoft indicate a rise in global cyber espionage, with nation-aligned groups from China, Russia, Belarus, Iran, and North Korea expanding their operations. These actors frequently target government, defense, and military sectors. Specific activities include Chinese-aligned groups targeting Taiwan’s semiconductor industry and Russian-aligned groups focusing on military objectives in Europe and Ukraine.

A significant trend across these operations is the increasing integration of artificial intelligence and large language models to accelerate tasks such as malware development, phishing, and target research. 

North Korean hacking groups, specifically Jade Sleet, Coral Sleet, and Jasper Sleet, have reportedly reached high levels of AI integration. Microsoft threat intelligence reports that these groups have reached the highest stage of AI integration, using it to automate routine operational procedures. Tactics include using generative AI for target research, creating fake identities, and crafting phishing lures, such as generating hundreds of customized PDF phishing documents in minutes. These groups also employ AI coding tools like Cursor for code generation and error correction.

Furthermore, researchers noted the use of the open-source AI penetration testing framework, ARTEX, by groups such as Onyx Sleet. North Korean actors are also expanding into software supply-chain compromises. A group tracked as DeceptiveDevelopment has been observed stealing developer credentials to inject malware into trusted repositories, including npm and PyPI. Additionally, North Korean IT workers have used fake identities to secure remote employment at hundreds of overseas companies, facilitating the theft of sensitive source code and intellectual property.

## Claims

- Three North Korean hacking groups have integrated AI into their daily operational procedures. (reported by 2 sources)
- One North Korean organization generated over 100 customized PDF phishing documents between August and September 2026. (reported by 2 sources)
- A phishing simulation involving hygiene inspection reports resulted in a 92 percent click rate. (reported by 2 sources)
- Jade Sleet, Coral Sleet, and Jasper Sleet are classified as being at the highest stage of AI utilization. (reported by 1 source)
- North Korean hackers use AI coding tools like Cursor for code generation and error correction. (reported by 1 source)
- The group DeceptiveDevelopment steals developer credentials to plant malware in repositories like npm and PyPI. (reported by 1 source)
- Lazarus Group used AI-generated profile pictures on resume websites during Operation FlashHole. (reported by 1 source)
- North Korean IT workers used fake identities to gain employment at 309 US companies. (reported by 1 source)

## Timeline

### 2026-10-29: North Korean hacking groups leverage AI for cyberattacks

North Korean hacking groups are increasingly integrating AI into their operations to automate phishing, develop malware, and conduct software supply-chain attacks and identity fraud.

12 sources. https://clstr.news/cluster/hancom-launches-nomadian-ai-workforce-platform-to-target-us-market

### 2026-10-28: ESET report shows rise in global cyber espionage and AI use

An ESET report on APT activity from April to September 2026 highlights increased cyber espionage by China, Russia, Iran, and North Korea, alongside the growing use of AI in malware development.

4 sources. https://clstr.news/cluster/cyber-espionage-activity-increases-globally-reports-eset

---
Cite as: Global cyber espionage and AI integration. CLSTR, https://clstr.news/situations/global-cyber-espionage-and-ai-integration