Chinese-nexus actor uses ARTEX AI tool to breach 123 Reg customer data

1. Executive summary

UK domain registrar 123 Reg disclosed that an intrusion on 18 September 2026 exposed customer contact data, customer relationship data, company VAT numbers and product information pulled from an API. The company attributes the breach to a China-nexus actor and says the ARTEX open-source agentic penetration-testing tool was used against it, the same tool CrowdStrike reported on 7 October 2026 in connection with attacks on South Korean financial organisations. No CVE has been assigned and no CISA KEV entry exists for this item; the intrusion is an operational compromise, not a patchable software flaw. The direct risk to EMEA financial services is second-order: the exposed fields (names, phone numbers, country, language and currency preferences, account creation dates, products held, marketing preferences, VAT numbers) are usable for targeted social engineering against organisations that hold 123 Reg domains or transact with its customers. The attribution is unconfirmed. 123 Reg names no actor that has a MITRE ATT&CK profile, and its China-nexus assessment rests on its own investigation plus a suspected link to the CrowdStrike-reported campaign.

2. Regulatory framing

3. Technical analysis & attack chain

The confirmed sequence, from 123 Reg's disclosure:

1. On 18 September 2026 an external actor gained access to 123 Reg systems and read customer data.
2. The data read covered contact information, related customer relationship data, company VAT numbers and product information drawn from an API.
3. 123 Reg's investigation identified IP addresses it assesses as core attacker infrastructure, hosted in China and Singapore.
4. The company worked with Singapore-based ISPs to shut down attacker servers in the region, which it says helped disrupt the attack.
5. 123 Reg notified law enforcement, the FTC, and UK and EU data protection authorities, and brought in outside security support.

The specific initial-access vector, exploited component, persistence mechanism, privilege escalation path and command-and-control infrastructure are not disclosed in the source. The source does not name a CVE, a vulnerable product version, a port, a protocol, a file path, a registry key or a malware family. Analysts should not infer these from the ARTEX reference; the tool is named as observed in the attack, not as the confirmed entry point.

What the source does establish about the tooling: ARTEX is described as an open-source, Chinese-developed agentic penetration-testing tool released in July 2026. 123 Reg says its investigation found AI cyberattack "skills" hosted on Chinese infrastructure, including copies of skills open-sourced by Anthropic and several other AI exploitation frameworks and scripts. It also cites a mirror of "anthropic_skills" and account naming conventions on the Chinese servers as consistent with preparation of an AI-augmented operation. These are 123 Reg's characterisations of artefacts it says it found; the source does not publish the artefacts themselves, so none can be independently checked from this advisory.

On data access and impact: 123 Reg's customer email states the activity "was limited to reading" customer data. Its spokesperson said it is possible copies were created, and that this possibility prompted the notification. The affected fields, per the spokesperson, are names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, and marketing preferences, plus company VAT numbers. No passwords, payment card data or authentication secrets are listed as exposed. The source does not state how many customers were affected.

Attribution is unconfirmed and single-sourced. 123 Reg's China-nexus assessment rests on IP geolocation (China and Singapore), the presence of AI exploitation frameworks on Chinese-hosted infrastructure, and a suspected link to the actor CrowdStrike described in CSA-261162 on 7 October 2026 as an unknown, likely Chinese-speaking actor targeting South Korean financial organisations from late September 2026 using ARTEX. 123 Reg also floats a possible link to a group it says abused Claude Code against at least 30 organisations. No named actor in this item has a MITRE ATT&CK profile, and the overlap in timing and tooling is circumstantial. Treat the state-sponsorship claim as an assessment by the victim, not an established fact.

4. Mitigation & containment

P1 (within 24 hours)

• If your organisation holds domains, DNS, hosting or email through 123 Reg, treat the exposed account metadata as known to the attacker. Inventory which 123 Reg accounts your staff control and confirm two-step verification is enabled on each, since the exposed fields (names, phone numbers, products held) are the raw material for convincing impersonation.
• Brief service desk and finance staff that inbound contact claiming to be from 123 Reg may cite accurate account details. Enforce the callback rule in the customer notice: verify through the 123 Reg website login, never through a link or number supplied in the contact.
• Search mail and web logs for inbound messages referencing 123 Reg account, billing or domain-renewal actions in the period since 18 September 2026, and quarantine confirmed lures.

P2 (within 72 hours)

• Add 123 Reg to the third-party register with the breach date, exposed data categories and the outstanding question of whether copies were taken. Record that the vendor's attribution is unconfirmed.
• Where 123 Reg provides a service in a regulated process (domain control for customer-facing portals, DNS for payment or authentication endpoints), confirm registrar account access controls and registrar lock settings directly with the provider.
• Review whether any internal team has deployed ARTEX or comparable agentic penetration-testing frameworks. If so, confirm they run only against authorised targets with logged scope, since the source names ARTEX as the tool observed in this attack.

P3 (within 7 days)

• Run targeted awareness content on registrar-impersonation phishing that uses correct account data, and on the "we will never ask for your password, payment details or verification codes" pattern 123 Reg itself flagged.
• Reassess AI-tool and open-source agent framework dependencies under supply chain controls, including provenance of any "skills" or plugins pulled from external repositories.

No vendor patch applies: the source names no vulnerable product or version, and no CVE exists for this item.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. 123 Reg describes attacker infrastructure as hosted in China and Singapore but publishes no IP addresses, domains, hashes or file names.

The source does describe observable behaviours. These are single-sourced to 123 Reg and CrowdStrike reporting; verify before enforcement.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source provides no file hashes, command-line flags, mutex names, scheduled-task or service names, file paths, registry keys or hard-coded values. The only named artefacts (ARTEX, anthropic_skills, CSA-261162) are tool, repository and report names, not threat artefacts, and a rule built on them would detect reporting about the incident rather than the incident.

7. Sources

• The Register, "123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus", https://www.theregister.com/cyber-crime/2026/10/28/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus/5305936, 2026-10-28. Single source for all facts in this advisory; the CrowdStrike CSA-261162 report it cites was not provided and is referenced only as described by 123 Reg.

8. Adverse Trace position

Adverse Trace assesses this as a moderate-impact data exposure with unconfirmed, single-sourced attribution. No CVE, CVSS score or CISA KEV entry applies, so severity is set by the data exposed and the impersonation risk it creates, not by a patchable flaw. For EMEA financial services clients the exposure is indirect: the risk is targeted social engineering against staff and customers whose account details the attacker may now hold, plus third-party concentration where 123 Reg underpins domain or DNS services. We will monitor for publication of the CrowdStrike CSA-261162 detail and any 123 Reg artefact release, and will reissue this advisory if atomic indicators or a confirmed actor attribution become available. Clients should confirm their 123 Reg account inventory and two-step verification status this week and report back any impersonation attempts citing accurate account data.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.