Emerald Sleet

Emerald Sleet, a threat actor associated with North Korea, has been identified as a significant player in cyber espionage. This group is known for its sophisticated use of artificial intelligence and machine learning models (LLMs), leveraging them to enhance spear-phishing campaigns, research publicly known vulnerabilities, troubleshoot technical issues, and assist with various web technologies. Among the top targets of Emerald Sleet are organizations in sectors such as government, defense, and media, with a particular focus on experts on the Korean Peninsula. Notably, Emerald Sleet has exploited OpenAI’s ChatGPT, the same technology that forms the basis for Microsoft's Copilot, to conduct malicious activities. Microsoft, which has invested $13 billion in OpenAI, along with OpenAI itself, have reported disrupting hacking attempts from Emerald Sleet and other state-affiliated malicious actors. The North Korea-linked group has reportedly used OpenAI’s services for scripting tasks and phishing campaigns focused primarily on the Asia-Pacific region. Emerald Sleet, also known as Velvet Chollima, impersonates reputable academic institutions and non-governmental organizations (NGOs) to lure victims into providing expert insights and commentary about foreign policies related to North Korea. The group also uses LLMs to generate content for spear-phishing campaigns and to research think tanks, experts, and government organizations concerned with defense issues and North Korea's nuclear weapons program. As a part of the broader landscape of cyber threats, Emerald Sleet poses a significant risk due to its advanced use of AI and targeted approach to gathering intelligence.