In operator records recovered by Zscaler, prompts asked for scans of organizations in these places. No attacks were confirmed and no victims were reported.
Targets
- Organizations in Canada, China, Cuba, Hong Kong, India, Indonesia, Japan, Kazakhstan, Kenya, Malaysia, Nigeria, South Africa, South Korea, Taiwan, Thailand, the UAE, the UK, the US and Vietnam (not named)
Attribution
- ARTEX basis
- Records Zscaler recovered from the operator's environment directly show use of a customized ARTEX.
- Actor
- Zscaler: a Chinese-speaking operator; likely financially motivated.
- Same attacker?
- Zscaler describes this as broader targeting beyond the Korean case. Wiz says Microsoft and Zscaler tie ARTEX to two different actors.
Figures and definitions
| Countries and regions | 19 (listed in the blog, number not written); CRN says 19; Daily CyberSecurity banner says 20 |
|---|---|
| Time | 2026-08-04 to Oct 4 (UTC, prompt records) |
Related events
Sources (3)
- 2026-10-21 Vendor Zscaler ThreatLabz Inside a Global AI-Assisted Hacking Campaign
- 2026-10-25 Media Daily CyberSecurity Suspected Chinese Operator Uses ARTEX AI Framework in Global Hacking Campaign
- 未标 (不早于 202 Media CRN Asia Zscaler: AI-assisted hackers target financial and personal data across 19 markets