WEBVTT

1
00:00:03.200 --> 00:00:05.680
Good evening, and welcome to Decrypted.

2
00:00:05.680 --> 00:00:12.240
I'm Belinder. It's Thursday, the twenty-ninth of October, twenty twenty-six, and this is the evening edition.

3
00:00:12.240 --> 00:00:18.480
123 Reg says an AI-driven attack read its customer data.

4
00:00:18.480 --> 00:00:26.400
A UK domain registrar has told customers it was breached, in what it calls its first AI-driven cyberattack

5
00:00:26.400 --> 00:00:34.960
. 123 Reg, which is owned by GoDaddy, says an intruder read customer records on 18 September.

6
00:00:34.960 --> 00:00:38.400
The claims about how the attackers worked are the interesting part.

7
00:00:38.400 --> 00:00:42.000
And it pays to separate the evidence from the company's own assessment.

8
00:00:42.000 --> 00:00:45.360
So, what was actually taken?

9
00:00:45.360 --> 00:00:51.280
The Register reported on 28 October that notification emails reached customers this week.

10
00:00:51.280 --> 00:00:58.020
A company spokesperson listed names, phone numbers, countries, language and currency preferences, account cre

11
00:00:58.020 --> 00:01:01.400
ation dates, products held and marketing preferences.

12
00:01:01.400 --> 00:01:03.560
Company V A T numbers too.

13
00:01:03.560 --> 00:01:06.320
Passwords and payment details are not listed.

14
00:01:06.320 --> 00:01:11.520
The company says the attacker only read the data, but copies may have been made.

15
00:01:11.520 --> 00:01:16.080
A customer notice reported by VINnews describes something slightly different.

16
00:01:16.080 --> 00:01:23.097
It mentions GoDaddy Websites + Marketing profile and contact details, reached through an A P I, the way one p

17
00:01:23.097 --> 00:01:26.880
rogram talks to another, also dated 18 September.

18
00:01:26.880 --> 00:01:32.187
The dates match. But neither source gives a customer count, or says how the attacker got in.

19
00:01:32.187 --> 00:01:35.440
Now, what about the AI claim?

20
00:01:35.440 --> 00:01:44.640
123 Reg says it found attack "skills" files on Chinese infrastructure, including copies of skills Anthropic

21
00:01:44.640 --> 00:01:48.240
had open sourced. It says the attacker used ar-tex.

22
00:01:48.240 --> 00:01:55.223
CrowdStrike published on 7 October that ar-tex is a recently released, open-source agentic penetration testi

23
00:01:55.223 --> 00:01:56.800
ng tool developed in China.

24
00:01:56.800 --> 00:02:02.752
It was used against South Korean financial firms, with the attacker's Claude Code session histories left expo

25
00:02:02.752 --> 00:02:07.160
sed. CrowdStrike has not attributed that activity to a named adversary.

26
00:02:07.160 --> 00:02:13.200
It assesses, with moderate confidence, a Chinese-speaking, financially motivated actor.

27
00:02:13.200 --> 00:02:20.240
The link between that campaign and 123 Reg rests on 123 Reg's suspicion and overlapping timing.

28
00:02:20.240 --> 00:02:25.840
The China nexus is its own reading of attacker addresses in China and Singapore.

29
00:02:25.840 --> 00:02:31.360
Treat both as claims. Think of an agentic tool as a tireless junior tester.

30
00:02:31.360 --> 00:02:36.320
You hand it a goal, it tries every door, reads what comes back and tries the next.

31
00:02:36.320 --> 00:02:41.680
It's cheaper than a skilled human, and patience stops being a scarce resource.

32
00:02:41.680 --> 00:02:43.840
So, what's the design lesson?

33
00:02:43.840 --> 00:02:48.440
The one mechanism reported is an A P I that handed back customer data.

34
00:02:48.440 --> 00:02:51.360
Secure by Design asks different questions of it.

35
00:02:51.360 --> 00:02:54.480
Does each caller see only the records it needs?

36
00:02:54.480 --> 00:03:01.040
Is there a rate limit? Does anything alert when a client reads methodically, record after record, at three in

37
00:03:01.040 --> 00:03:04.200
the morning? A read-only intrusion is quiet.

38
00:03:04.200 --> 00:03:06.560
No outage, no ransom note.

39
00:03:06.560 --> 00:03:13.312
The defender's only sign is in the logs, as a steady, systematic pattern of requests that no human customer w

40
00:03:13.312 --> 00:03:19.040
ould make. Scoping and rate limits are cheap at design time and expensive to retrofit.

41
00:03:19.040 --> 00:03:25.680
For UK organisations that hold domains here, the practical risk is phishing built from real account details.

42
00:03:25.680 --> 00:03:31.840
Turn on two-step verification, and log in through the registrar's website rather than links in emails.

43
00:03:31.840 --> 00:03:35.307
As always, this is opinion, not advice.

44
00:03:35.307 --> 00:03:39.600
That was Decrypted, with me, Belinder.

45
00:03:39.600 --> 00:03:43.040
The written version and every source are linked in the show notes.

46
00:03:43.040 --> 00:03:46.480
Thanks for listening. Stay patched, and stay sceptical.