Jasper Sleet is Microsoft’s designation for North Korean remote IT-worker activity, previously tracked as Storm-0287. Microsoft publicly profiled the actor under the Jasper Sleet name in June 2025 while describing a broader operation it had tracked since at least early 2020. The workers obtain remote software-development, web-development, and administrative roles using stolen or rented identities, fabricated documents, false professional profiles, staffing intermediaries, and facilitators who manage local devices, bank accounts, phone numbers, and employment checks. Their operations generate revenue for the North Korean government while enabling theft of source code, intellectual property, trade secrets, and other sensitive information; some workers have also extorted employers. Jasper Sleet uses VPNs, proxies, remote-management tools, laptop farms, developer platforms, and increasingly AI-assisted image editing and voice-changing software to conceal workers’ identities and locations and improve fraudulent applications.