CyberWire Daily AI as Tradecraft: How Threat Actors Are Operationalizing AI [Microsoft Threat Intelligence Podcast]
Mar 12, 2026
Vlad Honyanyy, a threat intel analyst studying North Korean–linked cyber activity, and Greg Schlomer, a researcher on DPRK-aligned operations, discuss how AI is woven into attacker workflows. They cover AI-powered phishing and persona fabrication, accelerated malware development, autonomous agents building exploits, and how AI levels the playing field for less-skilled operators.
AI Snips
Chapters
Transcript
Episode notes
AI Accelerates Rapid Iteration In Attacks
- AI is being integrated across the attack lifecycle to accelerate iteration and scale operations.
- Vlad Honyanyy observed rapid experimentation where groups test new vectors, expand on successes, and discard failures within months.
AI Suits Decentralized Scrappy Operations
- AI fits the scrappy, startup-like workflow of many DPRK-aligned operators, enabling fast iteration and experimentation.
- Greg Schlomer noted decentralized cells use different tools and rapidly adopt AI to try new tactics without centralized approval.
IT Worker Cells Lead AI Adoption
- Early AI adopters among DPRK groups are large scale IT-worker operations like Jasper Sleet and Storm 1877, not the rigid intelligence bureaus.
- Greg Schlomer explained bureaucratic intelligence units may be slower to adopt compared with flexible IT worker cells.