Zscaler ThreatLabz Reconstructs Attacker's Multi-Model Orchestration Mechanism: GLM Reviews DeepSeek, Scripts Maintain State Across Sessions

In October 2026, Seongsu Park, a researcher at Zscaler ThreatLabz, published a technical analysis of an AI-assisted attack campaign. CrowdStrike had previously reported separately on the related ARTEX infrastructure and attacks targeting South Korean financial institutions. The core contribution of this report lies in reconstructing the attacker's complete working environment—configuration files, synchronization scripts, prompt histories, and project file structures—to piece together a specific mechanism for multi-model collaborative orchestration.

The key design of this mechanism is role division and a mutual review loop. Prompt history shows that the attacker instructed the DeepSeek model to conduct initial investigations. Once DeepSeek reported that it had exhausted all attack surfaces, the attacker would then launch the GLM model to review the work performed by DeepSeek and its sub-agents. One translated prompt reads: "When DeepSeek says it has exhausted all attack surfaces and I say to start a GLM review, GLM should review DeepSeek's previous work and its subagents' work." Subsequent prompts expanded GLM's role from simple review to include additional investigation tasks. On the jump server, the attacker also assigned research tasks to Grok and instructed another AI session to review Grok's output.

Role division alone was insufficient to keep the workflow running after sessions disconnected. The attacker deployed three types of custom synchronization scripts: tools/sync-all.sh uses SSH and rsync to copy AI instructions, reusable task guides, saved notes, and tools to multiple accounts on the jump server; synchronizes AI-saved note files to the jump server; and synchronizes shared Claude Code instructions to the gemini and glm accounts on the work server. These scripts also included backup and validation checks to avoid overwriting modified target files.