/
← Voltar ao feed
high financial services cryptocurrency retail education logistics telecommunications

Chinese-speaking operator orchestrates ARTEX with Claude Code, Codex, DeepSeek, GLM and Grok to automate attacks worldwide

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 03:17 · coletado há 2 dias

A Chinese-speaking threat operator combined the agentic penetration-testing framework ARTEX with Claude Code, Codex and configurations requesting DeepSeek, GLM and Grok models to coordinate attacks on organizations worldwide. Recovered prompts dated August 4 to October 4, 2026 referenced targets in financial services, cryptocurrency, retail, education, logistics, telecommunications and other sectors. The records describe attempted investigations and desired outcomes, not confirmed compromises at every organization named. The research (ThreatLabz, with CrowdStrike independently identifying the jump server) extends earlier Zscaler reporting on South Korean financial institutions, where about 67,000 people's data was exfiltrated. Microsoft attributes ARTEX use against hundreds of organizations to Storm-0940, while Recorded Future's related TAG-217 investigation found cryptocurrency-theft and Linux exploitation tooling. Language alone does not establish nationality or state sponsorship, and ARTEX use does not prove that separate campaigns share an operator.

Detalhes técnicos

  • Infrastructure: a work server held project files, AI settings, scripts and a customized ARTEX deployment. A jump server at 38.244.50[.]120 routed traffic to targets and hosted more AI sessions. CrowdStrike found exposed directories containing Claude Code histories, configs and operational instructions.
  • Orchestration: ARTEX's planner split objectives into tasks, worker agents ran tools, and retained findings informed later actions. The container added Nmap, SQLmap, Nuclei, httpx, JADX, Apktool and Frida.
  • Model routing: ARTEX requested deepseek-v4.1-flash through an OpenAI-compatible gateway at xcai[.]pro. Codex requested deepseek-v4-pro through DeepSeek's API. Claude Code settings often requested DeepSeek, GLM or Grok rather than Anthropic models. These are requested routes; investigators could not verify which models actually answered.
  • Workflow: DeepSeek investigated targets, GLM reviewed its findings for missed attack surface, and Grok did remote research with separate review sessions. Three sync scripts distributed instructions, notes and tools. A context hook attached summaries to new prompts. Proxy exits, SSH tunnels and background monitors supported operations. Backblaze B2 stored reports, evidence, source code, exports and backups.
  • Targeting: prompts prioritized phone numbers, personal records, transaction histories, administrative access and payment credentials. Requests to decrypt fields, translate database schemas into Chinese and investigate underground marketplaces suggest preparation to monetize stolen data.
  • Microsoft reports Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 attempts per minute.
  • Earlier Zscaler reporting documented SQL injection and authentication bypass against peripheral South Korean financial applications.

Remediação

  • Prioritize exposed applications and enforce record-level authorization.
  • Detect sequential enumeration and investigate unusual bulk data transfers.
  • Monitor for high-rate tenant sign-in attempts.
  • Re-fang the defanged indicators only inside controlled platforms.

Linha do tempo

  1. gbhackers.com ↗ · pub. 22/10/2026 03:17 · coletado 22/10 04:00 primeiro registro

    Chinese-speaking operator orchestrates ARTEX with Claude Code, Codex, DeepSeek, GLM and Grok to automate attacks worldwide

    ler a análise desta fonte

    A Chinese-speaking threat operator combined the agentic penetration-testing framework ARTEX with Claude Code, Codex and configurations requesting DeepSeek, GLM and Grok models to coordinate attacks on organizations worldwide. Recovered prompts dated August 4 to October 4, 2026 referenced targets in financial services, cryptocurrency, retail, education, logistics, telecommunications and other sectors. The records describe attempted investigations and desired outcomes, not confirmed compromises at every organization named. The research (ThreatLabz, with CrowdStrike independently identifying the jump server) extends earlier Zscaler reporting on South Korean financial institutions, where about 67,000 people's data was exfiltrated. Microsoft attributes ARTEX use against hundreds of organizations to Storm-0940, while Recorded Future's related TAG-217 investigation found cryptocurrency-theft and Linux exploitation tooling. Language alone does not establish nationality or state sponsorship, and ARTEX use does not prove that separate campaigns share an operator.

    Technical Details

    • Infrastructure: a work server held project files, AI settings, scripts and a customized ARTEX deployment. A jump server at 38.244.50[.]120 routed traffic to targets and hosted more AI sessions. CrowdStrike found exposed directories containing Claude Code histories, configs and operational instructions.
    • Orchestration: ARTEX's planner split objectives into tasks, worker agents ran tools, and retained findings informed later actions. The container added Nmap, SQLmap, Nuclei, httpx, JADX, Apktool and Frida.
    • Model routing: ARTEX requested deepseek-v4.1-flash through an OpenAI-compatible gateway at xcai[.]pro. Codex requested deepseek-v4-pro through DeepSeek's API. Claude Code settings often requested DeepSeek, GLM or Grok rather than Anthropic models. These are requested routes; investigators could not verify which models actually answered.
    • Workflow: DeepSeek investigated targets, GLM reviewed its findings for missed attack surface, and Grok did remote research with separate review sessions. Three sync scripts distributed instructions, notes and tools. A context hook attached summaries to new prompts. Proxy exits, SSH tunnels and background monitors supported operations. Backblaze B2 stored reports, evidence, source code, exports and backups.
    • Targeting: prompts prioritized phone numbers, personal records, transaction histories, administrative access and payment credentials. Requests to decrypt fields, translate database schemas into Chinese and investigate underground marketplaces suggest preparation to monetize stolen data.
    • Microsoft reports Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 attempts per minute.
    • Earlier Zscaler reporting documented SQL injection and authentication bypass against peripheral South Korean financial applications.

    Remediation

    • Prioritize exposed applications and enforce record-level authorization.
    • Detect sequential enumeration and investigate unusual bulk data transfers.
    • Monitor for high-rate tenant sign-in attempts.
    • Re-fang the defanged indicators only inside controlled platforms.