Zscaler details AI setup behind a global hacking campaign
Original title: Inside a Global AI-Assisted Hacking Campaign
Jump host 38.244.50.120 routed connections to targets while ARTEX requested DeepSeek through an unverified gateway.
Zscaler ThreatLabz describes infrastructure from an operator in a global AI-assisted hacking campaign previously reported by Recorded Future. A work server stored project files and a local ARTEX deployment, while jump server 38.244.50.120 was the default route to targets. Custom scripts synchronized AI instructions across accounts configured for DeepSeek, GLM, and Grok. Requested model IDs were not independently verified.
Unconfirmed: ThreatLabz says the gateway may not have served the requested model, and the setup for each task was unconfirmed.
- The ARTEX container image is tagged artex-local:perf2-20261003.
- Added tools include nmap, sqlmap, nuclei, httpx, jadx, apktool, and frida-tools.
- PostgreSQL 16 maps to 127.0.0.1:5435 and the interface uses host port 8890.
- One prompt told GLM to review DeepSeek after it reported attack surfaces exhausted.
Impact: AI-assisted intrusion workflow against campaign targets
- Products
- Claude Code
- Malware
- ARTEX
- Organizations
- Recorded Future
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 38.244.50.120 | AI settings, and a local ARTEX deployment. The jump server, 38.244.50.120, served as the default route for connections to targets. Th |
From the original article
7 min read at zscaler.com
IntroductionIn October 2026, Zscaler ThreatLabz investigated AI-assisted cyberattacks that combined the ARTEX penetration testing framework with AI coding assistants and custom automation scripts. Initial reporting of the incident identified the targeting of South Korean financial institutions. However, ThreatLabz discovered additional information about the attack, which went far beyond South Korea.
By Seongsu Park (Staff Threat Researcher) · zscaler.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.