Microsoft Reports Threat Actors Using AI Across the Cyberattack Lifecycle
Summary
Microsoft says threat actors use generative AI for reconnaissance, phishing, identity fraud, malware development and post-compromise tasks. It recommends stronger identity defenses and monitoring for abnormal credential use.
Key points
- Microsoft reports AI is helping threat actors accelerate reconnaissance, phishing, infrastructure setup, malware development and post-compromise activity.
- Microsoft says North Korean groups Jasper Sleet and Coral Sleet use AI in remote IT worker schemes, including creating realistic identities and communications.
- AI tools can help draft phishing lures, translate content, summarize stolen data, generate or debug code, and configure infrastructure.
- Microsoft reports threat actors use jailbreak techniques to evade AI safeguards and are experimenting with agentic AI; human operators still control objectives and deployment.
- Microsoft advises treating campaigns that abuse legitimate access as insider risks, hardening identity systems, monitoring abnormal credential use and securing AI systems.
Article Details
- Event Type
- Microsoft reported that threat actors are increasingly using generative AI across the cyberattack lifecycle.
- Impact
- AI is being used to accelerate and scale reconnaissance, phishing, fraudulent identity creation, infrastructure provisioning, malware development, and post-compromise activity. Microsoft says human operators still control objectives, targeting, and deployment decisions, while some actors are experimenting with agentic AI.
MITRE ATT&CK
Threat Actors
Coral SleetMicrosoft reports that this North Korean actor uses AI in remote IT worker schemes and to generate fake company sites, provision infrastructure, and troubleshoot deployments. Microsoft identifies Storm-1877 as another name for Coral Sleet.Jasper SleetMicrosoft reports that this North Korean actor uses generative AI to create fraudulent digital personas and tailor them to remote IT worker roles. Microsoft identifies Storm-0287 as another name for Jasper Sleet.Storm-0287Microsoft reports that this North Korean actor uses generative AI to create fraudulent digital personas and tailor them to remote IT worker roles. Microsoft identifies Storm-0287 as another name for Jasper Sleet.Storm-1877Microsoft reports that this North Korean actor uses AI in remote IT worker schemes and to generate fake company sites, provision infrastructure, and troubleshoot deployments. Microsoft identifies Storm-1877 as another name for Coral Sleet.