{"schema_version":"0.10.0","id":"LR-2026-0307","record_version":2,"title":"North Korean group uses AI to mass-produce tailored phishing PDFs against South Korean users","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":4.72},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"d851c128e965adfe11250d6f741586fbeae8a6372f6acafd935c78d47cf17b06"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"ARTEX","tools_granted":["AI coding tools","AI penetration testing framework"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Phishing lure document generation, fake recruitment and identity disguise, malware development, and penetration testing in cyberattacks","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-30","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"North Korean hacking groups used AI tools, including the ARTEX open-source penetration-testing framework and AI coding tools such as Cursor, to mass-produce phishing lure documents, fake job offers and malware. One group created more than 100 customized PDF lure documents tailored to each target from August to September, and fake job offers were made to AI, blockchain and cybersecurity workers via three front companies. Microsoft Threat Intelligence reported the findings, evaluating that three of eight North Korean groups reached an \"operational integration\" stage, and recommended stronger identity verification for job applicants, phishing response and malware detection.","tags":["north-korea","phishing","ai-assisted-cyberattack","agentic-ai","supply-chain"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate: Over 100 customized phishing documents were tailored to individual South Korean targets, and fake job offers targeted industry workers.","harm_class":["third_party_security"],"affected_description":"South Korean users targeted with phishing; workers in the AI, blockchain, and cybersecurity industries targeted with fake job offers","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://news.sbs.co.kr/english/article.do?news_id=N1008823304","publisher":"news.sbs.co.kr","date":"2026-10-30","type":"press","title":"Dozens in Minutes with AI... North Korean Hacking Groups Target South Korea","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"C","system.intended_use":"C","system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.tags":"C","event.responsible_party":"D","event.adversarial_actor":"D","event.agent_involved":"C","event.detection_method":"D","event.incident_class":"D","event.summary":"D","event.date_disclosed":"A","event.trigger":"D","impact.harm_class":"D","impact.affected_description":"C","impact.severity":"D","context.denominator_available":"D","context.country":"D","impact.severity_because":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"MS revealed that \"Onyx Sleet\" (domestic name Andariel) and \"Pearl Sleet,\" organizations affiliated with North Korea's Reconnaissance General Bureau, have been utilizing \"ARTEX,\" an open-source AI penetration testing framework, in their operations since late October."}],"system.tools_granted":[{"source_index":0,"quote":"MS analyzed that North Korean hacking groups likely received support for code generation, bug fixing, and the development of detection-evasion technologies by utilizing AI coding tools such as Cursor."},{"source_index":0,"quote":"MS revealed that \"Onyx Sleet\" (domestic name Andariel) and \"Pearl Sleet,\" organizations affiliated with North Korea's Reconnaissance General Bureau, have been utilizing \"ARTEX,\" an open-source AI penetration testing framework, in their operations since late October."}],"system.intended_use":[{"source_index":0,"quote":"In particular, AI was found to have been utilized in phishing attacks targeting South Korean users as well."}],"event.detection_method":[{"source_index":0,"quote":"These findings on North Korean hacking groups' use of AI were included in a report released by Microsoft (MS) Threat Intelligence on the 29th (local time)."}],"event.tags":[{"source_index":0,"quote":"The scope of AI utilization is also expanding from fake recruitment and identity disguises to malware development and software supply chain attacks."},{"source_index":0,"quote":"Agentic AI-based hacking tools were also utilized in actual attacks."}],"event.responsible_party":[{"source_index":0,"quote":"MS revealed that \"Onyx Sleet\" (domestic name Andariel) and \"Pearl Sleet,\" organizations affiliated with North Korea's Reconnaissance General Bureau, have been utilizing \"ARTEX,\" an open-source AI penetration testing framework, in their operations since late October."}],"event.adversarial_actor":[{"source_index":0,"quote":"North Korean hacking groups are reportedly increasing the speed and scale of their cyberattacks, such as mass-producing phishing documents targeting South Korean users by leveraging artificial intelligence (AI)."}],"event.incident_class":[{"source_index":0,"quote":"North Korean hacking groups are reportedly increasing the speed and scale of their cyberattacks, such as mass-producing phishing documents targeting South Korean users by leveraging artificial intelligence (AI)."}],"event.agent_involved":[{"source_index":0,"quote":"Agentic AI-based hacking tools were also utilized in actual attacks."}],"impact.harm_class":[{"source_index":0,"quote":"In particular, AI was found to have been utilized in phishing attacks targeting South Korean users as well."}],"impact.affected_description":[{"source_index":0,"quote":"There was also a case where fake job offers were made to workers in the AI, blockchain, and cybersecurity industries utilizing three front companies from June 8 to 12 of this year."}],"impact.severity_because":[{"source_index":0,"quote":"One North Korean hacking group created more than 100 customized PDF lure documents tailored to each target from August to September of this year."}],"context.country":[{"source_index":0,"quote":"In particular, AI was found to have been utilized in phishing attacks targeting South Korean users as well."}],"event.summary":[{"source_index":0,"quote":"One North Korean hacking group created more than 100 customized PDF lure documents tailored to each target from August to September of this year."},{"source_index":0,"quote":"MS analyzed that North Korean hacking groups likely received support for code generation, bug fixing, and the development of detection-evasion technologies by utilizing AI coding tools such as Cursor."},{"source_index":0,"quote":"There was also a case where fake job offers were made to workers in the AI, blockchain, and cybersecurity industries utilizing three front companies from June 8 to 12 of this year."},{"source_index":0,"quote":"As a result of analyzing the AI adoption levels of eight North Korean hacking groups, MS evaluated that three of them have reached the \"operational integration\" stage, where AI is integrated into routine attack operations."},{"source_index":0,"quote":"It recommended that companies strengthen identity verification for job applicants, phishing response, and malware detection systems."}],"impact.severity":[{"source_index":0,"quote":"One North Korean hacking group created more than 100 customized PDF lure documents tailored to each target from August to September of this year."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-30"}]},"notes_on_gaps":"Only one source (SBS press, citing a Microsoft Threat Intelligence report). No model name, version, developer, permissions scope, autonomy level, deployment context, safeguard state, or production intent is stated for the AI tools; the implicated AI products (Cursor, ARTEX) are third-party tools misused by attackers, so no provider-side incident is described. No loss figure, record count, or third-party affected count is stated; third_parties_affected_count left null. No root cause of a system failure is stated (the 'failure' is deliberate attacker misuse), so root_cause and failure_class are omitted. No containment, pause, or remediation by any operator is stated; the only 'done' item is MS's recommendation. event.date_occurred omitted: the source gives attack windows (August-September; June 8-12) but not a single failure date. Detection attributed to Microsoft as an outside organisation, though the source describes a report rather than a live detection signal. incident_class security_compromise is a judgement: the AI tools were used by attackers, not breached themselves. event.trigger: human_misuse was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-11-01] system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.responsible_party: third_party. event.adversarial_actor: external_attacker. event.detection_method: a source states an outside organisation (a vendor, a partner, a platform) noticed it first. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.summary: classified from described behaviour. event.trigger: no source states a cause. impact.harm_class: third_party_security. context.denominator_available: no denominator is available for this incident. context.country: classified from described behaviour."},"context":{"industry":null,"org_size_band":null,"country":"KR","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"North Korean hacking groups used AI coding tools such as Cursor and the ARTEX penetration-testing framework to generate phishing lures, fake job offers and malware against South Korean users and industry workers.","quote":"MS analyzed that North Korean hacking groups likely received support for code generation, bug fixing, and the development of detection-evasion technologies by utilizing AI coding tools such as Cursor.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The groups used AI to scale attacks, producing over 100 customized PDF lure documents tailored per target and fake recruitment offers from front companies.","quote":"One North Korean hacking group created more than 100 customized PDF lure documents tailored to each target from August to September of this year.","source_index":0,"grade":"C"},{"step":"reached","text":"South Korean users were targeted with phishing, and AI, blockchain and cybersecurity workers received fake job offers from three front companies.","quote":"There was also a case where fake job offers were made to workers in the AI, blockchain, and cybersecurity industries utilizing three front companies from June 8 to 12 of this year.","source_index":0,"grade":"C"},{"step":"caught","text":"Microsoft Threat Intelligence analyzed the AI adoption levels of eight North Korean hacking groups and published its findings in a report.","quote":"As a result of analyzing the AI adoption levels of eight North Korean hacking groups, MS evaluated that three of them have reached the \"operational integration\" stage, where AI is integrated into routine attack operations.","source_index":0,"grade":"C"},{"step":"done","text":"MS recommended that companies strengthen identity verification for job applicants, phishing response and malware detection systems.","quote":"It recommended that companies strengthen identity verification for job applicants, phishing response, and malware detection systems.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-11-01","source_urls":["https://news.sbs.co.kr/english/article.do?news_id=N1008823304"]}}