Threats Tagged 'llm-powered attacks'

An unidentified, likely Chinese-speaking, financially motivated threat actor targeted South Korean financial institutions between late September and early October 2026, successfully exfiltrating data. The attacker used ARTEX, an open-source Chinese agentic penetration testing tool, combined with large language models such as DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 to enhance operational tempo and conduct multiple intrusions rapidly. Analysis revealed exposed ARTEX configuration files, Claude Code session histories, and a two-server infrastructure involving Hong Kong. The adversary also researched Korean data breach marketplaces and Telegram channels for monetizing stolen data. The campaign demonstrates sophisticated use of AI-driven tooling to conduct targeted intrusions against financial institutions.

In June 2026, infrastructure pivoting from TencShell C2 nodes revealed an active intrusion campaign utilizing AI language models for attack automation. Thirteen Hong Kong-based servers across four ASNs exposed an open directory containing victim source code, custom exploits, operational logs, and cloned login pages with notes in Simplified Chinese. The operation employed Claude Code for execution and DeepSeek-v4-pro for attack logic, targeting government systems in Afghanistan, Thailand, and Taiwan, along with reconnaissance against U.S. government portals. The campaign also pursued financial services firms across Europe, Australia, and Asia. Attackers deployed TencShell implants, webshells, and custom exploits including SQL injection and Laravel deserialization attacks, successfully compromising administrative systems and exfiltrating sensitive data including citizen complaints and government employee information.

MediumMalwareUnited StatesAfghanistanTaiwan+2#phishing#vshell#gshell