Coral Sleet

Coral Sleet, formerly tracked by Microsoft as Storm-1877 and also identified as PurpleDelta and Wagemole, is a North Korean state-sponsored threat actor involved in fraudulent remote IT worker operations. Its dominant objective is revenue generation for the North Korean regime through employment obtained under false identities. The operation targets companies internationally, particularly in the United States and Europe, using fabricated professional personas, stolen identities, tailored résumés, and false credentials to secure remote technical roles and abuse legitimate organizational access. Coral Sleet uses generative AI to accelerate persona creation and social engineering, tailoring applicants to particular job markets and roles. Voice-changing software helps operatives disguise their accents during remote interviews. The broader operation uses VPN services and facilitator-managed systems to conceal workers’ locations and make them appear to be domestic employees. Fraudulent employment provides sustained insider access; associated operations have also involved stealing sensitive employer data and source code for extortion. Coral Sleet uses development platforms and AI-assisted coding tools to rapidly create and manage convincing web infrastructure for campaign staging, testing, and command-and-control operations. It uses AI to generate, refine, and reimplement malware components, including bypassing model safeguards to obtain malicious code. Its observed agentic AI workflows connect lure development, fake company website creation, remote infrastructure provisioning, and payload testing and deployment. These capabilities accelerate operator-controlled activity rather than establishing fully autonomous attacks.