Threat reportThreat IntelligenceTL-2026-3986
Abliterated and Resold AI Models Fueling Cybercrime Underground; ARTEX-Assisted Intrusions at South Korean Banks (Flare Quantitative Analysis)
Abliterated and Resold AI Models Fueling Cybercrime (TL-2026-3986), also tracked as Abliterated model underground market, is a high-severity tracked intrusion set, first published 2026-10-20. It has no confirmed attribution, affects Langflow Langflow, references 6 CVEs (CVE-2025-3248, CVE-2021-29441, CVE-2026-81578), maps to 15 MITRE ATT&CK techniques (T1003.001, T1003.006, T1053.003), and is covered by 9 detection rules and 21 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-3986
- Threat ID
- TL-2026-3986
- Also known as
- Abliterated model underground market, ARTEX bank intrusions, JadePuffer, PaperCut AI agent campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, education, cloud, government administration, technology
- Target regions
- south korea, North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Abliterated and Resold AI Models Fueling Cybercrime
Malware and tooling: GROK, JadePuffer, ARTEX, Certipy, Claude Code, Ligolo-ng
How Abliterated and Resold AI Models Fueling Cybercrime works
Flare Research reports abliterated AI model mentions on cybercrime forums rose 745% from January to October 2026 (11 to 93 unique mentions in a trailing 30-day window), with Telegram and elite-forum vendors selling model access well below official prices. The report ties AI-enabled tooling to real intrusions, including attacks on South Korean financial institutions using the open-source agentic pentest tool ARTEX with DeepSeek, GLM-5.3 and Grok models.
Flare Research (author Eric Clay, published 2026-10-20) analyzed more than 100,000 Telegram channels and 100 dark web forums (data collection January 2025 to October 16, 2026) to quantify the underground market for abliterated and resold AI models. Abliteration strips refusal behavior from open-weight models by identifying and projecting out safety-tuning vectors in the weights; it needs direct weight access and preserves most other capabilities. Mentions rose 745% (about 11 unique mentions in January 2026 to 93 in the 30 days to October), with a sharp inflection after the GLM-5.2 release in mid-June 2026 and further escalation after GLM-5.3 in September 2026. Flare identified 17 distinct Telegram vendor handles (9 active in the trailing 30 days) and 11 handles across XSS.is, Exploit.in and BreachForums (7 active). 65% of Telegram vendors advertise multiple models. Access is sold as web panels or logins, self-hosted weights, API keys and Telegram bots. Pricing is far below official rates: DeepSeek median about 1/16 of the official price, Kimi about 1/100, while GLM trades at a median 2.6x markup. Of 100,342 Exploit.in posts from January 1 to October 20, 2026, 2,913 (2.9%) were AI-related, and 15 of 101 GLM-mentioning AI posts were flagged critical-risk (automated fake-account creation with proxies and virtual cards, jailbreaking frontier LLMs through warm-up prompts and multi-agent chaining, autonomous agent networks with exploitation playbooks, multi-model pipelines that bypass safety filters). Forum posts also describe agent harnesses aimed at IoT devices (zero-auth RCE research, masscan enumeration) and rented GPU capacity such as 16x B200 offers and RunPod instances.
The report links this market to operational incidents. Per CrowdStrike (report of 2026-10-07), an unattributed Chinese-speaking, financially motivated operator (moderate confidence) used ARTEX, an open-source agentic penetration-testing tool from China (developer Autumn-27, GitHub since 2026-07-26, AGPL-3.0, closed-sourced 2026-10-08), against South Korean financial institutions from late September to early October 2026. DeepSeek v4.1-flash was the primary backend, reached through the API reseller xcai[.]pro, with GLM-5.3 and Grok 4.6 used in additional Claude Code sessions. Open directories on attacker servers exposed Claude Code session histories, ARTEX configs and memory files, including reconnaissance on Korean data-sale channels and Telegram groups. Reported victims include Shinhan Bank (about 25,000 customers: names, phone numbers, annual income, loan limits), KB Kookmin, Hana, BNK Busan and Yegaram Savings Bank; press reports total roughly 68,000 people.
Flare also cites related 2026 AI-driven cases: JadePuffer (Sysdig), where an LLM agent ran the chain from Langflow RCE CVE-2025-3248 through Nacos (CVE-2021-29441 auth bypass) to AES_ENCRYPT-encrypting 1,342 Nacos configuration items with an unrecoverable key; the PaperCut campaign (GreyNoise), where hundreds of agents using OpenAI Codex and DeepSeek exploited CVE-2026-81578 and CVE-2026-82078 to compromise 440 instances at 395 organizations in 48 countries from 2026-08-31; and a Pakistan-based vibe-coded OSINT tool found through stealer logs. Defenders should expect lower skill barriers, faster exploit development, and predictable LLM-generated payloads that create detection opportunities. Single primary source (Flare); secondary details corroborated via CrowdStrike coverage (Security Affairs, Cyber Magazine), BleepingComputer and Help Net Security.
MITRE ATT&CK techniques used in TL-2026-3986
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1003.006 OS Credential Dumping: DCSync; T1552 Unsecured Credentials
Persistence
T1053.003 Scheduled Task/Job: Cron; T1136.002 Create Account: Domain Account
Execution
T1059.006 Command and Scripting Interpreter: Python
Command and Control
T1090 Proxy; T1572 Protocol Tunneling
Initial Access
T1190 Exploit Public-Facing Application
Impact
Lateral Movement
T1550.002 Use Alternate Authentication Material: Pass the Hash
Resource Development
T1587.004 Develop Capabilities: Exploits; T1588.002 Obtain Capabilities: Tool; T1588.007 Obtain Capabilities: Artificial Intelligence
Reconnaissance
Affected products and versions in Abliterated and Resold AI Models Fueling Cybercrime
- Langflow — Langflow
Vulnerable versions: < 1.3.0
Fixed in: 1.3.0 - PaperCut — PaperCut NG/MF
Vulnerable versions: versions affected by CVE-2026-81578 and CVE-2026-82078
Fixed in: vendor emergency patches - Alibaba — Nacos
Vulnerable versions: versions affected by CVE-2021-29441
Fixed in: patched releases - South Korean financial sector — Loan inquiry and employee mobile work-support systems
Vulnerable versions: not disclosed
Remediation for Abliterated and Resold AI Models Fueling Cybercrime
Patches
- Langflow 1.3.0 or later (CVE-2025-3248)
- PaperCut vendor emergency patches for CVE-2026-81578 and CVE-2026-82078
- Nacos release with authentication bypass fix (CVE-2021-29441)
Immediate actions
- Block and monitor the ARTEX-related infrastructure listed in IOCs (38.244.50.120:18899, proxy IPs, xcai.pro) at the perimeter and proxy
- Patch or isolate Langflow (upgrade to 1.3.0 or later for CVE-2025-3248), Alibaba Nacos (CVE-2021-29441) and PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) instances exposed to the internet
- Hunt for cron jobs beaconing every 30 minutes, base64-encoded Python payloads, and README_RANSOM tables in MySQL/Nacos databases
- Rotate credentials and API keys reachable from internet-facing AI workflow and print-management servers
Workarounds
- Restrict network access to Langflow /api/v1/validate/code
- Remove internet exposure of PaperCut, Langflow and Nacos management interfaces
Longer-term hardening
- Treat agentic AI tooling traffic (LLM API calls to DeepSeek, reseller domains, tool-use patterns) as an egress monitoring category
- Assume exploit development time is shrinking; prioritize KEV-listed and internet-facing patching SLAs
- Segment databases and configuration services (Nacos, MySQL) from application hosts and remove standing root credentials
- Monitor underground sources for abliterated-model offerings and stolen AI API keys tied to your organization
CVEs associated with Abliterated and Resold AI Models Fueling Cybercrime
CVE-2025-3248, CVE-2021-29441, CVE-2026-81578, CVE-2026-82078, CVE-2021-42278, CVE-2021-42287
Weaknesses (CWE) in Abliterated and Resold AI Models Fueling Cybercrime
Timeline of Abliterated and Resold AI Models Fueling Cybercrime
- Langflow 1.3.0 released fixing unauthenticated RCE CVE-2025-3248 in /api/v1/validate/code
- CVE-2025-3248 reported exploited in the wild and added to CISA KEV
- Flare baseline: about 11 unique abliterated-model mentions on cybercrime sources in the trailing 30 days
- GLM-5.2 released (mid-June); sharp inflection in underground interest in GLM-based abliterated models
- Sysdig reports JadePuffer, an LLM-agent ransomware chain from Langflow RCE to encryption of 1,342 Nacos configuration items
- ARTEX open-source agentic pentest tool first published on GitHub by Autumn-27 (AGPL-3.0)
- GreyNoise-observed AI-agent campaign against PaperCut NG/MF begins, eventually hitting 440 instances at 395 organizations in 48 countries
- Late September: intrusions into South Korean financial institutions using ARTEX and LLM backends begin
- CrowdStrike publishes analysis of the ARTEX-assisted attacks on South Korean banks
- ARTEX developer converts the GitHub project to closed source, denying responsibility for misuse
- Flare Research publishes the quantitative analysis: 745% rise to 93 abliterated-model mentions
Sources cited for Abliterated and Resold AI Models Fueling Cybercrime
- AI Models Are Fueling a New Wave of Cybercrime: A Quantitative Analysis (Flare Research)
- AI-Driven tool ARTEX used in attacks against South Korean Banks (Security Affairs)
- CrowdStrike: How a Cyber Attacker hit South Korean Banks (Cyber Magazine)
- CSA research note: ARTEX agentic pentest bank breaches
- ARTEX Developer Closes AI Pentest Tool After Korea Bank Hacks (AI Weekly)
- JadePuffer ransomware used AI agent to automate entire attack (BleepingComputer)
- AI-powered attack exploited PaperCut flaws to hack 395 organizations (BleepingComputer)
- RCE flaw in tool for building AI agents exploited by attackers (CVE-2025-3248) (Help Net Security)
- U.S. CISA adds Langflow flaw to its Known Exploited Vulnerabilities catalog (Security Affairs)
- CVE-2025-3248 (GCVE-0-2025-3248)
Detection coverage for TL-2026-3986
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3986 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.