CyberWire Daily AI as Tradecraft: How Threat Actors Are Operationalizing AI [Microsoft Threat Intelligence Podcast]
Mar 12, 2026
Vlad H., a Microsoft analyst studying DPRK-linked actors and AI-driven social engineering, and Greg Schlomer, a Microsoft analyst on DPRK-aligned cyber tradecraft, discuss Jasper Sleet’s operational use of AI. They cover AI across recon, malware development, persona fabrication, autonomous agents, jailbreaking, and how AI speeds and scales deception and campaign workflows.
AI Snips
Chapters
Transcript
Episode notes
AI Drives Rapid Iteration And Scale
- Threat groups like Storm 1877 are iterating and scaling attacks much faster by embedding AI across reconnaissance, development, and workflows.
- Vlad H. observed rapid experimentation: try a vector, test in the wild, expand if successful, discard if not.
Startup Style Experimentation In Threat Operations
- AI adoption by DPRK-linked operators is beyond experimentation and mirrors startup-style rapid testing and pivoting.
- Greg Schlomer notes decentralized cells and freedom to experiment accelerate adoption among scrappy actors.
Organizational Structure Shapes AI Adoption
- More bureaucratic intelligence-focused groups may adopt AI slower than decentralized IT-worker cells.
- Greg Schlomer contrasts large flexible IT-worker operations with rigid Citrine/Jade Sleet intelligence orgs.