Storm-0940 used ARTEX and AI coding agents against many targets
Original title: Hackers Combine Claude Code, Codex, Grok, and DeepSeek to Automate Attacks Worldwide
Microsoft says the group tried more than 2,250 tenants at about 2,900 sign-ins a minute.
Zscaler ThreatLabz describes a Chinese-speaking operator combining a customized ARTEX deployment with Claude Code, Codex and Grok workspaces. Prompts dated August 4 through October 4, 2026 named financial, crypto, retail, education, logistics and telecom targets, but the records describe attempted investigations rather than confirmed compromise at every organization. Microsoft says China-aligned Storm-0940 used ARTEX to automate sign-in attempts against hundreds of organizations. Earlier Zscaler reporting documented SQL injection against peripheral South Korean financial applications and theft of information on about 67,000 people.
Unconfirmed: Recovered prompts do not confirm compromise at every named organization, and ARTEX use does not prove separate campaigns share one operator.
- Listed infrastructure includes work servers 23.248.226.250–254 and jump host 38.244.50.120.
- ARTEX requested deepseek-v4.1-flash; Codex requested deepseek-v4-pro.
- The container added Nmap, SQLmap, Nuclei, httpx, JADX, Apktool and Frida.
- Investigators could not verify which models actually answered each session.
- Chinese-language prompts alone do not establish nationality or state sponsorship.
Impact: Automated tenant sign-in attempts and earlier theft of personal records
- 1.Prioritize exposed applications and enforce record-level authorization.
- 2.Detect sequential enumeration and investigate unusual bulk transfers.
- Products
- Claude CodeCodex
- Threat actors
- Storm-0940TAG-217
- Malware
- ARTEX
- Organizations
- MicrosoftZscalerCrowdStrikeRecorded FutureThreatLabz
- Countries
- ChinaSouth Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | xcai.pro | deepseek-v4.1-flash through an OpenAI-compatible gateway at xcai[.]pro. Codex requested deepseek-v4-pro through DeepSeek’s API. |
| ipv4 | 23.248.226.250 | an operator. Indicators Of Compromise Indicator Description 23.248.226.250 Work server 23.248.226.251 Work server 23.248.226.252 Work |
| ipv4 | 23.248.226.251 | Compromise Indicator Description 23.248.226.250 Work server 23.248.226.251 Work server 23.248.226.252 Work server 23.248.226.253 Work |
| ipv4 | 23.248.226.252 | ption 23.248.226.250 Work server 23.248.226.251 Work server 23.248.226.252 Work server 23.248.226.253 Work server 23.248.226.254 Work |
| ipv4 | 23.248.226.253 | erver 23.248.226.251 Work server 23.248.226.252 Work server 23.248.226.253 Work server 23.248.226.254 Work server 38.244.50.120 Jump s |
| ipv4 | 23.248.226.254 | erver 23.248.226.252 Work server 23.248.226.253 Work server 23.248.226.254 Work server 38.244.50.120 Jump server Note: IP addresses an |
| ipv4 | 38.244.50.120 | cripts, and a customized ARTEX deployment. A jump server at 38.244.50[.]120 routed connections toward targets and hosted additional A |
From the original article
3 min read at gbhackers.com
A Chinese-speaking threat operator combined ARTEX, Claude Code, Codex, and configurations requesting DeepSeek, GLM, and Grok models to coordinate attacks against organizations worldwide. The investigation expands earlier reporting on South Korean financial institutions, exposing a workflow built around shared instructions, persistent project records, and automated handoffs between AI sessions.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.