{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "North Korean actors have operationalized AI to scale attacks. This hunt provides the correlation needed to find automated lure delivery and 'agentic' post-exploitation frameworks that individual rules miss." }, "name": "AI-Scaled Social Engineering and Access", "type": "investigation", "labels": [ "hunt", "attack.t1566.001", "attack.t1195.002", "attack.t1059", "attack.t1543", "attack.t1027", "execution", "initial access", "persistence" ], "related": [ { "hunt": "ai-mcp-server-remote-source", "reason": "Existing rules target MCP server exploitation; this hunt looks for broader agentic frameworks like ARTEX.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule might detect a tool name, but this hunt correlates the automated creation of dozens of PDFs with subsequent high-speed discovery command bursts, providing the context of an AI-scaled operation.", "coverage": [ { "stage": "initial-access-ai-tailored-phishing", "steps": [ "automated-lure-bursts", "early-stage-triage" ], "status": "covered" }, { "stage": "initial-access-trojanized-repositories", "steps": [ "trojan-repo-clones", "early-stage-triage" ], "status": "covered" }, { "stage": "execution-agentic-framework-artex", "steps": [ "artex-agentic-recon", "follow-on-triage" ], "status": "covered" }, { "stage": "persistence-and-evasion-ai-tooling", "steps": [ "cursor-persistence-check", "follow-on-triage" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "AI-Tailored Phishing Lures", "slug": "initial-access-ai-tailored-phishing", "tactic": "initial-access", "techniques": [ "T1566.001" ], "observables": [ "PDF lure files created in rapid succession (dozens in minutes)", "Job-themed filenames and content (software engineer, recruitment)", "Email or outreach referencing spoofed AI-powered blockchain intelligence companies", "Tailored recruiter or investor domains used for contact" ] }, { "name": "Trojanized Private Repository Lures", "slug": "initial-access-trojanized-repositories", "tactic": "initial-access", "techniques": [ "T1195.002" ], "observables": [ "Cloned private source code repositories containing trojanized logic", "Git activity involving malicious repository lures", "Malicious code refactored or generated using AI dev platforms" ] }, { "name": "Agentic AI Framework Execution", "slug": "execution-agentic-framework-artex", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "Process launches for 'ARTEX' agentic AI penetration testing framework", "Automated penetration testing commands and scripts launched via AI agents", "Execution of commands generated via agentic workflows for reconnaissance and exploitation" ] }, { "name": "AI-Assisted Tooling and Persistence", "slug": "persistence-and-evasion-ai-tooling", "tactic": "persistence", "techniques": [ "T1543", "T1027" ], "observables": [ "Usage of Cursor AI-assisted development platform for script modification", "AI-generated persistence mechanisms (services, scheduled tasks)", "AI-refactored obfuscation layers in scripts and malware", "Commands and scripts troubleshooting errors as observed in command line logs" ] } ], "summary": "North Korean threat actors are leveraging generative and agentic AI to scale reconnaissance, social engineering, and malware development, including the rapid generation of tailored PDF lures and the use of the ARTEX framework for automated penetration testing. These campaigns frequently use fake job-themed personas and front companies to deliver trojanized code via private repositories or initiate malicious interview workflows." }, "severity": "high", "rationale": "Focus on hosts belonging to software engineers, blockchain researchers, and recruitment staff. Machines without development tools like git or VS Code are lower priority but should still be scanned for PDF bursts.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder uses generative AI to produce high-volume tailored lures and trojanized repositories, subsequently deploying agentic frameworks like ARTEX for automated reconnaissance and persistence.", "parameters": { "recon_tools": { "from": { "ref": "msrc-blog-2026-10-29", "kind": "article", "observed": "2026-10-29" }, "type": "list[string]", "default": [ "whoami", "net", "tasklist", "systeminfo", "ipconfig", "sc", "quser", "query" ], "description": "Common reconnaissance tools executed by agentic frameworks like ARTEX." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-10-29" }, "type": "list[host]", "default": [], "description": "Specific hosts to narrow the hunt; leave empty to scan the entire estate." }, "lookback_days": { "from": { "ref": "default-retention", "kind": "manual", "observed": "2026-10-29" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "lure_keywords": { "from": { "ref": "msrc-blog-2026-10-29", "kind": "article", "observed": "2026-10-29" }, "type": "list[string]", "default": [ "resume.pdf", "interview_prep.pdf", "blockchain_intelligence.pdf", "software_engineer_jd.pdf", "salary_details.pdf" ], "description": "Exact filenames of suspected AI-generated lures to filter for in the file activity query." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/", "name": "Tracking AI adoption in North Korean threat actor tradecraft" } ], "blind_spots": [ { "id": "limited-endpoint-visibility", "risk": "An attacker compromises a personal machine or shadow-IT host that lacks telemetry, bypassing the lure-burst detection.", "stage": "initial-access-ai-tailored-phishing", "question": "Whether lures were delivered to machines not enrolled in the monitoring platform.", "requires": "Full agent coverage across recruitment and engineering teams" }, { "id": "git-repository-audit-gap", "risk": "Without repository audit logs, we can see the 'clone' but cannot verify if the actor exfiltrated source code or committed malicious changes back to the origin.", "stage": "initial-access-trojanized-repositories", "question": "Which specific private repository was accessed or modified via trojanized lures.", "requires": "hb_cloud_api_activity for GitHub or GitLab" } ] }, "name": "AI-Scaled Social Engineering and Access", "description": "This hunt identifies North Korean threat actor tradecraft that incorporates AI as a force multiplier. It begins by identifying automated lure generation (dozens of PDFs created in minutes) and suspicious repository interaction. The hunt then pivots to find evidence of agentic AI frameworks\u2014detecting the automated command bursts typical of ARTEX\u2014and AI-assisted development tools used for persistence." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "initial-access-ai-tailored-phishing", "steps": [ "automated-lure-bursts", "early-stage-triage" ], "status": "covered" }, { "stage": "initial-access-trojanized-repositories", "steps": [ "trojan-repo-clones", "early-stage-triage" ], "status": "covered" }, { "stage": "execution-agentic-framework-artex", "steps": [ "artex-agentic-recon", "follow-on-triage" ], "status": "covered" }, { "stage": "persistence-and-evasion-ai-tooling", "steps": [ "cursor-persistence-check", "follow-on-triage" ], "status": "covered" } ], "rationale": "An intruder uses generative AI to produce high-volume tailored lures and trojanized repositories, subsequently deploying agentic frameworks like ARTEX for automated reconnaissance and persistence.", "blind_spots": [ { "id": "limited-endpoint-visibility", "risk": "An attacker compromises a personal machine or shadow-IT host that lacks telemetry, bypassing the lure-burst detection.", "stage": "initial-access-ai-tailored-phishing", "question": "Whether lures were delivered to machines not enrolled in the monitoring platform.", "requires": "Full agent coverage across recruitment and engineering teams" }, { "id": "git-repository-audit-gap", "risk": "Without repository audit logs, we can see the 'clone' but cannot verify if the actor exfiltrated source code or committed malicious changes back to the origin.", "stage": "initial-access-trojanized-repositories", "question": "Which specific private repository was accessed or modified via trojanized lures.", "requires": "hb_cloud_api_activity for GitHub or GitLab" } ], "scoping_notes": "Focus on hosts belonging to software engineers, blockchain researchers, and recruitment staff. Machines without development tools like git or VS Code are lower priority but should still be scanned for PDF bursts.", "beyond_detection": "A single rule might detect a tool name, but this hunt correlates the automated creation of dozens of PDFs with subsequent high-speed discovery command bursts, providing the context of an AI-scaled operation." } }, { "id": "scoping-dev-tools", "type": "query", "label": "Scope development and AI tools", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%git%' OR LOWER(package_name) LIKE '%cursor%' OR LOWER(package_name) LIKE '%vscode%' OR LOWER(package_name) LIKE '%python%')", "surface": "hb_software_inventory", "description": "Identify hosts with development environments or AI assistants as these are the primary targets for North Korean supply chain and remote-worker operations.", "expected_signal": "Hostnames belonging to developers, researchers, or recruiters. Silence indicates no development software is present in the inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope development and AI tools", "reads": [ "package_name", "device_hostname" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%git%' OR LOWER(package_name) LIKE '%cursor%' OR LOWER(package_name) LIKE '%vscode%' OR LOWER(package_name) LIKE '%python%')", "silence": "not_evidence_of_absence", "expected": "Hostnames belonging to developers, researchers, or recruiters. Silence indicates no development software is present in the inventory.", "verified": "dry-run", "verified_at": "2026-10-30" } }, { "id": "automated-lure-bursts", "type": "query", "label": "Automated PDF lure creation bursts", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, COUNT(*) as pdf_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_file_activity WHERE LOWER(file_name) LIKE '%.pdf' AND (LOWER(file_path) LIKE '%\\\\downloads\\\\%' OR LOWER(file_path) LIKE '%\\\\desktop\\\\%' OR LOWER(file_path) LIKE '%/downloads/%' OR LOWER(file_path) LIKE '%/desktop/%') AND (instr(',' || '{{lure_keywords}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR '{{lure_keywords}}' = '') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname HAVING pdf_count >= 10", "surface": "hb_file_activity", "description": "Detect the rapid creation of multiple PDF files in user-writable paths, characteristic of AI-scaled phishing lures.", "expected_signal": "A single host creating 10 or more PDFs in a short window. Silence suggests no automated lure bursts occurred in monitored paths." }, "parents": [ { "id": "scoping-dev-tools" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Automated PDF lure creation bursts", "reads": [ "file_name", "file_path", "device_hostname", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, COUNT(*) as pdf_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_file_activity WHERE LOWER(file_name) LIKE '%.pdf' AND (LOWER(file_path) LIKE '%\\\\downloads\\\\%' OR LOWER(file_path) LIKE '%\\\\desktop\\\\%' OR LOWER(file_path) LIKE '%/downloads/%' OR LOWER(file_path) LIKE '%/desktop/%') AND (instr(',' || '{{lure_keywords}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR '{{lure_keywords}}' = '') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname HAVING pdf_count >= 10", "silence": "evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "new_this_window" }, "expected": "A single host creating 10 or more PDFs in a short window. Silence suggests no automated lure bursts occurred in monitored paths.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "file_name" ], "rare_below": 2 }, "verified_at": "2026-10-30" } }, { "id": "trojan-repo-clones", "type": "query", "label": "Suspicious git repository cloning", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%git%' AND LOWER(process_cmd_line) LIKE '%clone%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify git clones from external sources, which may deliver AI-refactored trojanized logic.", "expected_signal": "Users cloning repositories from unusual domains. Silence means no git network activity was recorded on these hosts." }, "parents": [ { "id": "scoping-dev-tools" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Suspicious git repository cloning", "reads": [ "process_name", "process_cmd_line", "device_hostname", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE LOWER(process_name) LIKE '%git%' AND LOWER(process_cmd_line) LIKE '%clone%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Users cloning repositories from unusual domains. Silence means no git network activity was recorded on these hosts.", "verified": "dry-run", "verified_at": "2026-10-30" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Triage early intrusion signals", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "automated-lure-bursts", "trojan-repo-clones" ], "objective": "Evaluate if the PDF creation patterns or git clone commands match the automated, AI-enabled profiles of North Korean lures.", "description": "Determine if the observed file bursts or git clones indicate a successful AI-assisted intrusion.", "max_iterations": 3, "expected_signal": "A per-host verdict on initial access attempts.", "success_criteria": "A verdict of malicious | suspicious | benign per host, citing specific rows and timing." }, "parents": [ { "id": "automated-lure-bursts", "kind": "merge" }, { "id": "trojan-repo-clones", "kind": "merge" } ] }, { "id": "artex-agentic-recon", "type": "query", "label": "ARTEX agentic command bursts", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, parent_pid, parent_process_name, COUNT(DISTINCT REPLACE(LOWER(process_name), '.exe', '')) as unique_recon_cmds, MIN(time) as start_time, MAX(time) as end_time FROM hb_process_activity WHERE instr(',' || '{{recon_tools}}' || ',', ',' || REPLACE(LOWER(process_name), '.exe', '') || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, parent_pid HAVING unique_recon_cmds >= 3 AND (strftime('%s', MAX(time)) - strftime('%s', MIN(time))) <= 60", "surface": "hb_process_activity", "description": "Identify the agentic footprint of ARTEX by searching for bursts of unique discovery commands from a single parent.", "expected_signal": "A parent process executing 3+ distinct recon tools in 60 seconds. Silence indicates no automated recon bursts were detected." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "ARTEX agentic command bursts", "reads": [ "process_name", "parent_pid", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, parent_pid, parent_process_name, COUNT(DISTINCT REPLACE(LOWER(process_name), '.exe', '')) as unique_recon_cmds, MIN(time) as start_time, MAX(time) as end_time FROM hb_process_activity WHERE instr(',' || '{{recon_tools}}' || ',', ',' || REPLACE(LOWER(process_name), '.exe', '') || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, parent_pid HAVING unique_recon_cmds >= 3 AND (strftime('%s', MAX(time)) - strftime('%s', MIN(time))) <= 60", "silence": "evidence_of_absence", "expected": "A parent process executing 3+ distinct recon tools in 60 seconds. Silence indicates no automated recon bursts were detected.", "verified": "dry-run", "verified_at": "2026-10-30" } }, { "id": "cursor-persistence-check", "type": "query", "label": "AI-assisted persistence mechanisms", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, service_name, service_cmd_line, time FROM hb_service_activity WHERE (LOWER(service_cmd_line) LIKE '%appdata%' OR LOWER(service_cmd_line) LIKE '%public%' OR LOWER(service_cmd_line) LIKE '%/tmp/%') AND activity_id = 1 AND LOWER(service_cmd_line) NOT LIKE '%code%' AND LOWER(service_cmd_line) NOT LIKE '%cursor%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_service_activity", "description": "Identify services in user-writable paths, potentially refactored or generated using AI dev tools like Cursor.", "expected_signal": "New services pointing to profile-based binaries that are not known developer workers." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "AI-assisted persistence mechanisms", "reads": [ "service_cmd_line", "service_name", "device_hostname", "time" ], "source": "hb_service_activity", "target": "endpoint", "content": "SELECT device_hostname, service_name, service_cmd_line, time FROM hb_service_activity WHERE (LOWER(service_cmd_line) LIKE '%appdata%' OR LOWER(service_cmd_line) LIKE '%public%' OR LOWER(service_cmd_line) LIKE '%/tmp/%') AND activity_id = 1 AND LOWER(service_cmd_line) NOT LIKE '%code%' AND LOWER(service_cmd_line) NOT LIKE '%cursor%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "New services pointing to profile-based binaries that are not known developer workers.", "verified": "dry-run", "verified_at": "2026-10-30" } }, { "id": "follow-on-triage", "type": "analytic", "label": "Analyze full intrusion chain", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-stage-triage", "artex-agentic-recon", "cursor-persistence-check" ], "objective": "Correlate early signals from the first triage with the follow-on ARTEX bursts or service persistence found on the same hosts.", "description": "Connect early-stage lure delivery with subsequent agentic frameworks and persistence to confirm a full intrusion chain.", "max_iterations": 5, "expected_signal": "A comprehensive per-host verdict linking the entire attack chain.", "success_criteria": "A final verdict of malicious | suspicious | benign per host, citing the sequential chain of events." }, "parents": [ { "id": "artex-agentic-recon", "kind": "merge" }, { "id": "cursor-persistence-check", "kind": "merge" } ] }, { "id": "intrusion-decision", "type": "checkpoint", "label": "Intrusion decision", "config": { "fuzzy": true, "judge": "hunter", "question": "the follow-on triage verdict is malicious for at least one host", "condition": "the follow-on triage verdict is malicious for at least one host", "blind_spot": "limited-endpoint-visibility", "confidence": "high", "description": "Route the hunt based on the final agent verdict regarding AI-assisted intrusion.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "follow-on-triage" } ] }, { "id": "contain-host", "type": "action", "label": "Isolate impacted host", "config": { "target": "endpoint", "description": "Contain the threat actor's access by isolating the host from the network.", "instructions": "Isolate the host and revoke any credentials used by the target account in the lookback window.", "action_approval": "required" }, "parents": [ { "id": "intrusion-decision", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Deep analyst review", "config": { "assignee": "analyst", "description": "Perform deep analysis of the AI-generated scripts and confirm remediation.", "instructions": "Review the command bursts identified as ARTEX and any AI-refactored scripts found in user profiles. Document the lure filenames and the timing of the automated reconnaissance." }, "parents": [ { "id": "intrusion-decision", "branch": "default" }, { "id": "intrusion-decision", "branch": "on_unavailable" }, { "id": "contain-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document findings and update baseline data.", "instructions": "Record what was examined. If no activity was found, update the 'baseline' prevalence for PDF bursts to ensure legitimate automated tool updates are documented." }, "parents": [ { "id": "intrusion-decision", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }