Security researchers at Zscaler have reconstructed the working environment of a hacking operation that ran like a small AI startup: multiple AI models given different jobs, one model assigned to review another’s work, and saved project files so investigations could resume across sessions. The operator’s recovered prompt history shows targeting across 19 countries and territories, with the apparent goal of stealing personal and financial data for money.
The findings, published by Zscaler’s ThreatLabz team, describe a customized deployment of ARTEX, the open-source AI-assisted penetration-testing framework that has been appearing in attack after attack this month. Early reporting had focused on South Korean financial institutions; ThreatLabz found the campaign reached far beyond them.
How The Operator Ran The Campaign
The setup spanned two servers. A work server stored project files, scripts, AI settings and the local ARTEX deployment, while a jump server at 38.244.50.120 served as the default route to targets and ran additional AI sessions. Three custom scripts synchronized shared AI instructions, saved notes and tooling across accounts, with backups and validation checks designed to keep configurations consistent everywhere.
The ARTEX deployment was extended with offensive tooling — nmap, sqlmap, nuclei, httpx and Android analysis tools — packed into a Docker container backed by a PostgreSQL 16 database. Each investigation lived in folders holding scope definitions, discovered attack surfaces, progress notes and captured evidence, so an AI assistant could read the files and resume work in a later session. A hook script automatically attached a summary of testing status to every new prompt, and some settings permitted autonomous actions without explicit operator approval for each step.
Models Checking Each Other’s Work
The most striking detail is how the operator divided labor between AI models. The ARTEX workflow was configured to request DeepSeek’s V4.1 Flash model through an OpenAI-compatible gateway, a Codex workspace was pointed at DeepSeek’s V4 Pro, and accounts running the Claude Code application were configured with DeepSeek, GLM and Grok model settings, with Grok given research tasks on the jump server through a bridge service.
Prompts recovered by ThreatLabz show one model explicitly assigned to audit another. One instruction read: “When DeepSeek says it has exhausted all attack surfaces and I say to start a GLM review, GLM should review DeepSeek’s previous work and its subagents’ work.” Another assigned extensive research to Grok, then directed a separate AI session to review Grok’s output.
One caveat runs through all of this: Zscaler stresses that the model names are reproduced as the requested IDs from the operator’s configuration files and “were not independently verified” — “it’s possible that some sessions used Anthropic’s Claude models.” The workflow is confirmed; the exact model behind each session is not.
19 Countries, One Financial Motive
The prompt history, spanning August 4 to October 4, named targets in Canada, China, Cuba, Hong Kong, India, Indonesia, Japan, Kazakhstan, Kenya, Malaysia, Nigeria, South Africa, South Korea, Taiwan, Thailand, the United Arab Emirates, the United Kingdom, the United States and Vietnam. Sectors ranged from dating apps and SMS providers to cryptocurrency platforms, gift-card portals, gambling sites, retail, education, logistics and legal settlement systems.
The objectives point to money, not espionage. The operator asked for structured personal data and mobile phone numbers — at one point dismissing database dumps that lacked phone number fields as worthless — and sought payment gateway API keys, NFT minting exploits and unauthorized admin privileges. One prompt asked where stolen Korean data is usually sold. Notably, the operator warned the AI tools not to initiate direct account withdrawals, reasoning that unauthorized transactions could trigger security alerts.
Recorded Future’s researchers corroborated the operator’s infrastructure in a recent post, and CrowdStrike reported on related ARTEX infrastructure earlier in October — separate evidence that the framework is now shared tooling across multiple threat actors. Zscaler cybersecurity executive Deepen Desai urged organizations to respond with Zero Trust architecture, network segmentation and proactive vulnerability testing.
Why It Matters
This campaign shows what the offensive side of agentic AI looks like in practice: not a single rogue model, but a managed pipeline in which AI systems draft, check and resume each other’s work with minimal human supervision. The techniques — persistent project memory, specialist agents, cross-session handoffs — are the same ones enterprises use to make AI coding assistants productive, which means every advance in agent reliability is also an advance for operators like this one.
For defenders, the details are a gift: recovered prompts reveal the tooling, the gateways and the data the operators actually want. Symantec’s recent “Skynet mode” finding and Microsoft’s Storm-0940 attribution show the same ARTEX framework spreading across unrelated campaigns, which makes understanding this operator’s playbook useful far beyond it.
Background
ARTEX is an open-source AI-assisted penetration-testing framework with a planner-and-worker architecture: an operator defines a goal, AI agents break it into tasks, execute tools against the target and document their findings. Originally a legitimate security-testing tool, it has been adopted by threat actors through 2026 — GMO’s researchers tied it to cyberattacks on Japanese companies, Microsoft attributed the ConnectWise supply-chain compromise to the China-aligned group Storm-0940 using ARTEX, and Zscaler earlier found it abused against South Korean financial institutions. The new ThreatLabz analysis is the first to expose a full operator working environment, including the recovered prompt history that reveals how the models were orchestrated.
Source: Zscaler ThreatLabz ; Pocket News
0 Comments