Date: 10/23/2026
Severity: Medium
Summary
Researcher uncovered a global AI-assisted hacking campaign combining a customized ARTEX penetration-testing framework, AI coding assistants, and automation scripts to target organizations across multiple countries and industry sectors. The threat actor coordinated AI models including DeepSeek, GLM, and Grok to automate reconnaissance, and task execution, while maintaining persistent project context across AI sessions. Prompt histories revealed objectives involving unauthorized access, credential and API key theft, and exfiltration of personal and financial data, suggesting financially motivated cybercrime.
Indicators of Compromise (IOC) List
IP Address | 154.201.79.246 161.8.161.140 205.214.59.31 23.248.226.250 23.248.226.251 23.248.226.252 23.248.226.253 23.248.226.254 38.244.50.120 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | dstipaddress IN ("205.214.59.31","23.248.226.254","23.248.226.253","23.248.226.251","38.244.50.120","154.201.79.246","161.8.161.140","23.248.226.250","23.248.226.252") or srcipaddress IN ("205.214.59.31","23.248.226.254","23.248.226.253","23.248.226.251","38.244.50.120","154.201.79.246","161.8.161.140","23.248.226.250","23.248.226.252") |
Reference:
https://www.zscaler.com/blogs/security-research/inside-global-ai-assisted-hacking-campaign