# 123 Reg Discloses AI-Driven Cyberattack Linked to Chinese Nexus Domain registrar confirms customer data breach involving sophisticated AI exploitation frameworks and infrastructure. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-10-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/b8865da5-5f92-48e9-b82b-5a7b86c92564 ## Breach Incident Overview UK domain registrar 123 Reg confirmed an AI-driven cyberattack occurring on September 18, 2026. The intrusion resulted in the exposure of customer contact details, VAT numbers, and API-linked product information. Compromised data includes names, phone numbers, account creation dates, and language preferences, prompting official notifications to affected users this week. ## Attacker Infrastructure Analysis Investigations identified core attacker infrastructure hosted across China and Singapore. The company discovered AI cyberattack skills and scripts on these servers, including copies of open-source frameworks from Anthropic. These technical artifacts suggest a highly coordinated operation utilizing advanced agentic penetration-testing tools to bypass standard security protocols during the breach. ## Suspected State-Sponsored Actor 123 Reg suspects a Chinese state-sponsored group is responsible for the intrusion. This actor is reportedly known for targeting at least 30 organizations using Claude Code. The firm noted that naming conventions and technical mirrors found on the servers are consistent with the preparation of sophisticated, AI-augmented cyber operations. ## Link to Financial Attacks The attack mirrors recent campaigns targeting South Korean financial institutions. Evidence suggests the same actor utilized ARTEX, an open-source Chinese agentic penetration-testing tool released in July 2026. CrowdStrike’s October 7, 2026 report, CSA-261162, corroborates this timeline, confirming that the same tools were deployed against multiple international entities during September. ## Immediate Mitigation Actions Upon discovery, 123 Reg engaged external cybersecurity support and notified law enforcement, the FTC, and data protection authorities in the UK and EU. The company collaborated with Singapore-based ISPs to successfully shut down the attacker's servers, effectively disrupting the ongoing operation and preventing further unauthorized access to their internal systems. ## Data Exposure Scope While the company stated that the attacker's activity was primarily limited to reading data, they acknowledged the possibility that copies of information were created. This uncertainty regarding data exfiltration necessitated the formal customer notification process. The registrar is currently urging all users to remain vigilant against potential phishing or data misuse. ## Security Recommendations Provided 123 Reg advises customers to exercise extreme caution regarding unsolicited communications. The company explicitly stated they will never request passwords, payment details, or verification codes via email or phone. Users are strongly encouraged to enable two-step verification (2SV) immediately to add a critical layer of protection against potential credential harvesting attempts. ## Strategic Security Implications This incident highlights the growing threat of AI-augmented cyberattacks targeting infrastructure providers. By leveraging open-source AI exploitation frameworks, attackers can scale their operations against multiple targets simultaneously. Organizations must now account for agentic tools in their threat modeling, as traditional perimeter defenses may prove insufficient against these automated, evolving attack vectors. ## Sources covering this story - https://www.theregister.com/cyber-crime/2026/10/28/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus/5305936 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._