It was recently uncovered that North Korea-affiliated threat actors, particularly Emerald Sleet, are leveraging artificial intelligence (AI) and large language models (LLMs) to assist their cyber operations in a fashion that makes them more efficient and effective. This includes AI-assisted spear-phishing campaigns aimed at specialists on the Korean Peninsula and conducting vulnerability research and reconnaissance on relevant organizations. The use of AI extends to troubleshooting, scripting, and creating content for spear-phishing campaigns. Emerald Sleet’s engagements begin with seemingly benign conversations with targets in an effort to create relationships that will foster long-term information exchanges to gather strategic information important to North Korea’s interests. By adopting credible personas, often imitating think tanks or non-governmental organizations, along with the recent exploitation of weak email authentication policies, the group has increased its operational success rate and demonstrated agility in adjusting its tactics, including the use of web beacons for initial reconnaissance and target profiling. Moreover, North Korean hacking activities extend beyond Emerald Sleet, with groups like Jade Sleet (overlaps with UNC4899 or TradeTraitor) and Diamond Sleet (aka Lazarus Group) engaging in cryptocurrency thefts and sophisticated supply chain attacks. These operations have produced millions in stolen assets and showcased advanced methods of circumventing security measures, underscoring the persistent and evolving threat posed by these state-sponsored actors. The landscape of cyber threats from North Korean actors is increasingly sophisticated, leveraging both novel AI applications and advanced techniques to undermine security protections and facilitate malicious objectives, often positioned towards revenue generation for the country’s weapons program and intelligence collection on countries like the United States, South Korea, and Japan.