Storm-0287 was Microsoft's temporary designation for an emerging activity cluster later named Jasper Sleet. Microsoft uses Storm identifiers for developing groups until it has sufficient confidence to assign or merge a durable actor name, and in June 2025 it stated that Jasper Sleet was formerly Storm-0287. The cluster conducts a North Korean remote-worker operation in which skilled technology workers obtain employment under false identities to generate revenue and support state interests. Operators create or procure identities, fabricate resumes and developer profiles, use staffing firms and facilitators, and conceal their locations through virtual private networks, proxy services, remote-management tools, and laptop farms. Their targeting expanded from United States technology, manufacturing, and transportation organizations to technology-related roles across industries worldwide. Access gained through employment can enable theft of source code, intellectual property, and trade secrets, as well as extortion. Microsoft also observed AI-assisted document and image manipulation and experimentation with voice-changing software.