Artex: Over 800 Open Deployments Linked to Attacks

More than 800 instances of the Chinese-origin software Artex are accessible without a password, according to Censys. The open-source tool, described by Microsoft as a system of AI agents capable of conducting full intrusions, has been linked to operations targeting the Korean finance sector and ConnectWise. Artex now plans to restrict access to its future versions, while copies of the code remain online.

Online Copies and Restriction Announced by Artex

Dozens of copies of Artex's code are still available on sharing platforms and can be used in active attacks. Artex has announced that it will transition to closed-source mode, limiting future versions to paying customers. Microsoft indicated that the use of Artex has facilitated intrusions and data theft in client cloud environments at a speed that leaves little time for detection and response. Censys observed that the instance of Artex linked to attacks against the Korean finance sector had remained publicly exposed for months and appeared to contain attack data targeting payment and gaming companies as well.

Massive Exposure: Over 800 Deployments Accessible Without Password

According to Censys, more than 800 different instances of Artex are available on the Internet without any authentication required. Silas Cutler noted that not all of these instances are used for malicious activities, and many are intended for authorized testing. He emphasized that there is no technical reason for these systems to be exposed on the Internet, as the software does not require web access. Censys, which scans the Internet for exposed or vulnerable systems, made these observations during its regular analyses.

An Automated Tool Described by Microsoft and Linked to Campaigns

Artex is an autonomous penetration testing tool that automatically explores systems to detect vulnerabilities. Microsoft describes it as a set of AI agents capable of conducting a complete attack, from reconnaissance to data exfiltration, with minimal human intervention. Since its release in July, Artex has been associated with several cyberattacks, including large-scale operations against the Korean financial industry in September.

Attribution of Attacks and Basic Entry Vectors

CrowdStrike attributed attacks to a Chinese-speaking hacker who used an instance of Artex, identified notably through an open directory hosting the system. At the beginning of October, Artex was also used in an attack against ConnectWise, during which China-linked hackers were able to monitor thousands of organizations hosted on Microsoft's cloud. Several incidents involving Artex exploited basic vulnerabilities, such as the use of easily guessable or already known passwords, as well as the absence of two-factor authentication. Poor configuration can make both offensive tools and implants visible, exposing both victims and attackers to risks. Artex, open-source and free to deploy on one's own servers, is notably used by profiles lacking access to advanced cybersecurity AI models from Anthropic or OpenAI. The tool is of Chinese origin.