Coral Sleet

Coral Sleet is a North Korean state threat actor tracked by Microsoft, also referred to as Storm-1877 and additionally tracked by some teams as PurpleDelta and Wagemole. Microsoft describes Coral Sleet as one of the groups behind the DPRK fake IT worker scam, a long-running operation in which North Korean operatives use stolen or fabricated identities, fake credentials, tailored resumes, voice-changing software, and other deception to obtain remote employment at foreign companies, particularly in the United States and Europe. Reporting in the provided content states that this activity supports revenue generation for the North Korean regime and has also provided opportunities to exploit insider access; since late 2024, associated operators have also been reported stealing sensitive data and source code from employers and attempting extortion. Microsoft reporting in the provided content says Coral Sleet uses AI extensively as a force multiplier across this activity. Observed uses include rapidly creating digital personas for specific job markets and roles; supporting social engineering; and sustaining misuse of legitimate access. Microsoft also observed Coral Sleet using development platforms to quickly create and manage attack infrastructure at scale, including convincing high-trust web infrastructure, enabling faster campaign staging, testing, and command-and-control operations. Additional reporting in the content states Coral Sleet uses AI to quickly develop web infrastructure, generate and refine malware, and in some cases jailbreak AI tools. Microsoft also observed Coral Sleet demonstrating rapid capability growth through AI-assisted iterative development, including use of AI coding tools to generate, refine, and reimplement malware components. The content further states that Coral Sleet has experimented with agentic AI. Reported uses include semi-automated or automated workflows for creating fake company websites, remotely provisioning infrastructure, testing and deploying malicious payloads, refining phishing or lure development, maintaining persistence, and monitoring for opportunities. Microsoft notes in the provided content that large-scale operational use of agentic AI has not yet been observed due to reliability and operational constraints. Coral Sleet has also been cited alongside Jasper Sleet and Sapphire Sleet as a North Korean cluster using AI to shorten persona creation and support long-term persistence at low cost.