Date: 11/05/2026
Severity: High
Summary
The investigation uncovered an open directory at `23.248.226[.]250`, identified as a Hong Kong-based jump server containing Claude Code configurations, custom model-routing scripts, and 19 agent skills. The recovered tools supported reconnaissance, web testing, payment logic analysis, and mobile operations, while configuration files referenced DeepSeek, GLM, and Grok components, indicating a multi-model AI setup. Additional infrastructure included FOFA-related tools and a proxy service at `154.201.79[.]246:443`, with 79 unique exit IPs identified from an initial sample of 100 identities. Researchers also recovered cryptocurrency, Linux exploitation, reverse SSH tunneling, JNDI/LDAP exploitation, and mobile-device tools, although their direct connection to the reported South Korean breaches remains unconfirmed.
Indicators of Compromise (IOC) List
Domains/URLs | xcai.pro direct.xcai.pro fofoapi.com u6ud2s.dnslog.cn |
IP Address | 38.244.50.120 23.248.226.250 154.201.79.246 |
Hash | C7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842
|
HTTP title | ARTEX - 自主渗透测试控制台 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "fofoapi.com" or url like "fofoapi.com" or siteurl like "fofoapi.com" or domainname like "direct.xcai.pro" or url like "direct.xcai.pro" or siteurl like "direct.xcai.pro" or domainname like "u6ud2s.dnslog.cn" or url like "u6ud2s.dnslog.cn" or siteurl like "u6ud2s.dnslog.cn" or domainname like "xcai.pro" or url like "xcai.pro" or siteurl like "xcai.pro" |
Detection Query 2 : | dstipaddress IN ("23.248.226.250","38.244.50.120","154.201.79.246") or srcipaddress IN ("23.248.226.250","38.244.50.120","154.201.79.246") |
Detection Query 3 : | sha256hash In ("C7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842")
|
Reference:
AI-Powered Cyberattack Infrastructure Exposed