INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

123 Reg Discloses AI-Driven Cyberattack Suspected to be China Origin

| 2026-10-28 11:45 LOW LOW AI-ENABLED ATTACK DATA BREACH STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
On October 18, 2026, UK domain registrar 123 Reg disclosed that it was the victim of an "AI-driven cyberattack" that exposed customer data. The attackers are suspected to be from China and may be linked to a Chinese state-sponsored group known for abusing Claude Code in attacks against at least 30 organizations. Approximately 1 million customers were affected, with their contact information, company VAT numbers, product information from an API, names, phone numbers, countries, language and currency preferences, account creation dates, the products on the accounts, and marketing preferences compromised. The attack worked by using AI-driven skills hosted on Chinese infrastructure, including copies of open-source AI exploitation frameworks and scripts. As of October 28, 2026, law enforcement agencies have been notified, outside cybersecurity support has been brought in, and industry partners are assisting with disruption efforts to shut down the attacker's servers.
Technical Mitigations AI-generated
• Use two-step verification (2SV) to protect accounts, as recommended by 123 Reg. • Block or hunt for IP addresses hosted in China and Singapore, which were identified as core attacker infrastructure. • Detect the use of Anthropic AI exploitation frameworks and scripts, which were found on Chinese servers linked to the attack.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎July 2026
Threat actors used ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, to target customer data at 123 Reg.
target_region China
"That actor used ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, which was also observed to be used in the attack that targeted us.
target_region United States
"That actor used ARTEX, an open-source Chinese-developed agentic penetration-testing tool released in July 2026, which was also observed to be used in the attack that targeted us.
organisation GoDaddy
" The GoDaddy-owned registrar reported the attack to law enforcement agencies, brought in outside cybersecurity support, and notified the FTC, as well as the data protection authorities in the UK and EU.
organisation FTC
" The GoDaddy-owned registrar reported the attack to law enforcement agencies, brought in outside cybersecurity support, and notified the FTC, as well as the data protection authorities in the UK and EU.
organisation EU
" The GoDaddy-owned registrar reported the attack to law enforcement agencies, brought in outside cybersecurity support, and notified the FTC, as well as the data protection authorities in the UK and EU.
‎September 18
Threat actors using AI-driven tactics targeted 123 Reg's customer data on September 18.
source_region China
123 Reg described the September 18 intrusion as "the first known AI-driven cyberattack against our company," and told The Register that early signs point toward a China-nexus attacker.
general_metric 123 Reg discloses
123 Reg described the September 18 intrusion as "the first known AI-driven cyberattack against our company," and told The Register that early signs point toward a China-nexus attacker.
organisation The Register
123 Reg described the September 18 intrusion as "the first known AI-driven cyberattack against our company," and told The Register that early signs point toward a China-nexus attacker.
‎late September 2026
A Chinese-speaking actor targeted several South Korean financial organizations starting in late September 2026, which is also the period when CrowdStrike reported a similar incident.
target_region Korea, Republic of
"In addition, on October 7, 2026, CrowdStrike published CSA-261162, describing an unknown, likely Chinese-speaking actor that targeted several South Korean financial organizations starting in late September 2026, which is the same period during which we were attacked.
organisation CrowdStrike
"In addition, on October 7, 2026, CrowdStrike published CSA-261162, describing an unknown, likely Chinese-speaking actor that targeted several South Korean financial organizations starting in late September 2026, which is the same period during which we were attacked.
‎October 7, 2026
Threat actors using an unknown, likely Chinese-speaking actor targeted several South Korean financial organizations starting in late September 2026.
target_region Korea, Republic of
"In addition, on October 7, 2026, CrowdStrike published CSA-261162, describing an unknown, likely Chinese-speaking actor that targeted several South Korean financial organizations starting in late September 2026, which is the same period during which we were attacked.
organisation CrowdStrike
"In addition, on October 7, 2026, CrowdStrike published CSA-261162, describing an unknown, likely Chinese-speaking actor that targeted several South Korean financial organizations starting in late September 2026, which is the same period during which we were attacked.
‎2026/10/28
Threat actors used AI-augmented tools to target 123 Reg, a UK domain registrar, exposing customer data.
organisation ARTEX
cyber-crime 123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus Company chiefs believe the attackers could be the same as those who used ARTEX to breach South Korea’s financial giants UK domain registrar 123 Reg ( no relation – Ed ) says it was the victim of an “AI-driven cyberattack” that exposed customer data.
organisation IP
"Our investigation identified IP addresses that we assessed to be the core attacker infrastructure, which were hosted in China and Singapore, indicating a strong Chinese nexus," the spokesperson said.
victims 30 organizations
" They went on to say that many of the artefacts left behind led 123 Reg to suspect that a Chinese state-sponsored group, known for abusing Claude Code in attacks against at least 30 organizations, could be behind the break-in.
organisation TA
"The TA's mirror of 'anthropic_skills,' and the account naming conventions found on the Chinese servers are consistent with preparation of this class of AI-augmented operation," the spokesperson told us.
organisation VAT
Customers began receiving their notification emails this week, informing them that their contact information, "related customer relationship data," company VAT numbers, and "product information from an application programming interface (API)" were compromised.
organisation API
Customers began receiving their notification emails this week, informing them that their contact information, "related customer relationship data," company VAT numbers, and "product information from an application programming interface (API)" were compromised.
Tactical Metrics
Metrics
victims
30
Organizations
" They went on to say that many of the artefacts left behind led 123 Reg to suspect that a Chinese state-sponsored group, known for abusing Claude Code in attacks against at least 30 organizations, could be behind the break-in.
Intelligence Sources
The Register - Cybercrime 2026-10-28