ARTEX AI hacking framework found on 1,465 public servers, some hosting attack tools
- Severity
- Medium
- Sources
- 1
What happened
Censys reported ARTEX, a dual-use AI penetration-testing framework (Go backend, Next.js console, PostgreSQL) exposed on 1,465 hosts, with about 815 distinct deployments after removing clustered configurations. Co-hosted tools included CyberStrikeAI, Cobalt Strike, Vshell and Adaptix C2, and 32 open directories exposed exploits, Linux implants and operator files. CrowdStrike linked ARTEX to attacks on South Korean financial institutions, and Microsoft attributed ARTEX-assisted activity to Storm-0940. No CVEs are cited; defenders should correlate listed infrastructure and console signatures with authentication, endpoint and network telemetry.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Correlate any ARTEX console or listed infrastructure matches with authentication logs, endpoint activity and network connections before treating them as hostile.
- Check nearby open directories, tunnelling services, unfamiliar LLM gateways and historical scan records, as Censys recommends.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors
Malware
Companies
Products