ARTEX AI hacking framework found on 1,465 public servers, some hosting attack tools
AI SECURITYCensysredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
Censys identified ARTEX, a dual-use AI penetration-testing framework, on 1,465 internet-facing hosts, with roughly 815 distinct-looking deployments after repeated configurations are removed. Some servers also hosted Cobalt Strike, Vshell, CyberStrikeAI and other tools, and 32 open directories exposed exploits, implants and operator files. CrowdStrike and Microsoft have linked ARTEX-assisted activity to attacks, so defenders should correlate infrastructure matches with authentication logs, endpoint activity and network connections rather than treat every console as hostile.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Correlate any ARTEX console or listed infrastructure matches with authentication logs, endpoint activity and network connections before treating them as hostile.
- Check nearby open directories, tunnelling services, unfamiliar LLM gateways and historical scan records, as Censys recommends.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Threat actors
Malware
Companies
Products