The original text is in EN, taken from the source site. Source ↗

A Chinese-speaking threat operator combined ARTEX, Claude Code, Codex, and configurations requesting DeepSeek, GLM, and Grok models to coordinate attacks against organizations worldwide.

The investigation expands earlier reporting on South Korean financial institutions, exposing a workflow built around shared instructions, persistent project records, and automated handoffs between AI sessions.

Recovered prompts, dated August 4 through October 4, 2026, referenced targets across financial services, cryptocurrency, retail, education, logistics, telecommunications, and other sectors.

The records describe attempted investigations and desired outcomes, not confirmed compromises at every organization mentioned.

The operator maintained a work server containing project files, AI settings, scripts, and a customized ARTEX deployment. A jump server at 38.244.50[.]120 routed connections toward targets and hosted additional AI sessions.

CrowdStrike independently identified the address and exposed directories containing Claude Code histories, configuration files, and operational instructions

ARTEX supplied the orchestration layer: a planner divided objectives into tasks, worker agents executed tools, and retained findings informed subsequent actions.

The customized container added familiar offensive utilities, including Nmap, SQLmap, Nuclei, httpx, JADX, Apktool, and Frida, combining web exploitation, network discovery, and Android analysis within one environment.

Three synchronization scripts distributed instructions, saved notes, and supporting tools across servers and accounts.

Backups and validation checks helped preserve modified files, while model references were adjusted for destination workspaces.

Architectural diagram of AI-assisted attack environment using ARTEX (Source : Zscaler).

ThreatLabz discovered information, about an AI-assisted attack combining a customized ARTEX deployment with Claude Code, Codex, and Grok workspaces.

The configurations illustrate an important distinction between an AI client and its underlying model. Claude Code appeared throughout the environment, but associated settings requested DeepSeek, GLM, or Grok rather than necessarily Anthropic models.

AI-Powered Cyberattacks

ARTEX requested deepseek-v4.1-flash through an OpenAI-compatible gateway at xcai[.]pro. Codex requested deepseek-v4-pro through DeepSeek’s API.

These identifiers document requested routing; investigators could not independently verify which models actually answered individual sessions.

According to Microsoft, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries.

Prompts instructed DeepSeek to investigate targets before GLM reviewed its findings and subagents’ work for overlooked attack surfaces.

Storm-0940 used ARTEX to attempt to sign-in to more than 2,250 tenants at 2,900 sign-in attempts per minute, a pace that leaves defenders with little time to detect and respond.

Scale and speed of a subset of Storm-0940’s automated ARTEX campaign on downstream tenants, including tenant reach and rapid sign-ins (Source : Zscaler).

Grok received remote research assignments, with separate sessions tasked with reviewing its output.

This orchestration, rather than any single model, defined the operation: specialized agents shared work, challenged findings, and continued investigations under human direction.

Each project retained scope, attack-surface inventories, progress notes, vulnerability reports, and supporting evidence.

An automated context hook attached summaries to new prompts, helping sessions resume previous investigations instead of rebuilding context.

Proxy exits separated project traffic, SSH tunnels linked services between servers, and background monitors restarted interrupted components. Backblaze B2 stored archived reports, evidence, source code, exports, and backups.

Recorded Future’s related TAG-217 investigation also uncovered cryptocurrency-theft tooling, Linux exploitation capabilities, and mobile-security experimentation, although available evidence did not establish successful compromise across those activities.

Prompts prioritized phone numbers, personal records, transaction histories, administrative access, and payment credentials.

Requests to decrypt fields, translate database schemas into Chinese, and investigate underground marketplaces suggest preparation for monetizing stolen information.

Earlier Zscaler reporting documented SQL injection and authentication bypass against peripheral South Korean financial applications, with approximately 67,000 people’s information exfiltrated.

Defenders should prioritize exposed applications, enforce record-level authorization, detect sequential enumeration, and investigate unusual bulk transfers.

Chinese-language prompts support an assessment of a Chinese-speaking operator, but language alone does not establish nationality or state sponsorship. ARTEX usage likewise cannot establish that separate campaigns share an operator.

Indicators Of Compromise

IndicatorDescription
23.248.226.250Work server
23.248.226.251Work server
23.248.226.252Work server
23.248.226.253Work server
23.248.226.254Work server
38.244.50.120Jump server

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.