SOCRadarAmeer Owda
SOCRadar Maps 916 Exposed ARTEX AI Pentest Consoles in US
Part of the ARTEX story · since 30 Oct
- Fri 30 Oct, 19:00 UTC. The Hacker News, first report. CrowdStrike links Vapor Panda to global AI powered intrusion campaign.
- Sun 1 Nov, 09:20 UTC. cybersixt, its first report on the story. AI hacking tool ARTEX now used by cybercriminals to target finance.
- Mon 2 Nov, 09:00 UTC. SecurityOnline, its first report on the story. North Korean groups use AI to accelerate cyber operations.
- Tue 3 Nov, 00:51 UTC. cybersixt. WorkOS data breach came from a researcher's escaped ARTEX agent.
- Tue 3 Nov, 06:30 UTC. The Hacker News. Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys.
- Tue 3 Nov, 19:30 UTC. The Hacker News. Chainstack Breach Exposes Customer Data and Password Hashes.
- Wed 4 Nov, 11:00 UTC. badbyte.io, its first report on the story. Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts.
- Wed 4 Nov, 13:30 UTC. SecurityWeek, its first report on the story. Wiz links AI platform breaches to stolen access tokens.
- Thu 5 Nov, 10:00 UTC. SOCRadar, its first report on the story. AI Pentest Framework Tied to Attacks on Hundreds of Organisations.
- Thu 5 Nov, 10:30 UTC. The Hacker News. Backdoored ARTEX Docker image exposed 62 consoles to root access.
- Thu 5 Nov, 18:00 UTC. Check Point, its first report on the story. Check Point details AI driven ARTEX cybercrime campaigns.
- Fri 6 Nov, 13:30 UTC. Infosecurity, its first report on the story. Censys finds 1,465 internet exposed ARTEX consoles.
- Sat 7 Nov, 04:00 UTC. Microsoft, its first report on the story. Storm-3358 uses ARTEX to target financial organisations.
- Sat 7 Nov, 20:30 UTC. Security Affairs, its first report on the story. Hunt.io traces ARTEX tools to breaches at South Korean banks.
- Tue 10 Nov, 22:00 UTC. Dark Reading, its first report on the story. Storm-0940 weaponises Artex AI tool to breach cloud accounts.
- Thu 12 Nov, 00:00 UTC. Unit 42, its first report on the story. Unit 42 warns attackers are using AI red teaming tools.
- Thu 12 Nov, 15:30 UTC. SOCRadar. SOCRadar Maps 916 Exposed ARTEX AI Pentest Consoles in US. This article, 17th of 18.
- Thu 12 Nov, 22:30 UTC. Dark Reading. Researchers warn AntiFox is driving attacks on AWS environments.
SOCRadar researchers have mapped a large U.S. footprint of ARTEX, an open-source, AI-powered autonomous penetration-testing framework. From internet-wide scanner telemetry, they de-duplicated 1,295 U.S.-hosted candidate instances and, after re-validation, confirmed 916 live ARTEX-family consoles in a snapshot taken on 11 November 2026.
They note that the software is designed for authorised tests, but its web console is exposed at scale on U.S. commercial hosting, creating a sizeable attack surface alongside documented intrusions that used the same framework. Of the 916 live consoles, 896 are served over plain HTTP, and 512 sit across 19 contiguous /24 blocks, with many deployments sharing build fingerprints and certificates, suggesting templated rollout by a small number of operators.
SOCRadar documents several risk factors and deployment patterns: 231 U.S. ARTEX hosts also run a “Sub2API – AI API Gateway” on a second port; three clusters appear to be single-operator or shared-image deployments bound by shared builds, certificates and ETags. The researchers also flag backdoored Docker builds (tomicdd/artex and congdonglinux/artex) that, in a reported case, could execute root commands unauthenticated via a hidden verifyCaptcha() in the login handler, exposing a root shell on affected hosts.
Across the U.S. population, 62 consoles were observed on backdoored images (26 in the U.S.), with 637 GitHub repos still linking to the compromised images after takedown. The report highlights several indicators for defenders, including the console title suffix 自主渗透测试控制台, the favicon hash mmh3 -576220750, and ports 8787 and 8790, to aid detection and hunting.
How the story developed
18 articles from 12 outlets since 30 Oct. Still developing; the latest report was 2 hours ago. This was the 17th report, 13 days after the first.
- Fri 30 Oct, 19:00 UTC. The Hacker News, first report. CrowdStrike links Vapor Panda to global AI powered intrusion campaign.
- Sun 1 Nov, 09:20 UTC. cybersixt, its first report on the story. AI hacking tool ARTEX now used by cybercriminals to target finance.
- Mon 2 Nov, 09:00 UTC. SecurityOnline, its first report on the story. North Korean groups use AI to accelerate cyber operations.
- Tue 3 Nov, 00:51 UTC. cybersixt. WorkOS data breach came from a researcher's escaped ARTEX agent.
- Tue 3 Nov, 06:30 UTC. The Hacker News. Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys.
- Tue 3 Nov, 19:30 UTC. The Hacker News. Chainstack Breach Exposes Customer Data and Password Hashes.
- Wed 4 Nov, 11:00 UTC. badbyte.io, its first report on the story. Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts.
- Wed 4 Nov, 13:30 UTC. SecurityWeek, its first report on the story. Wiz links AI platform breaches to stolen access tokens.
- Thu 5 Nov, 10:00 UTC. SOCRadar, its first report on the story. AI Pentest Framework Tied to Attacks on Hundreds of Organisations.
- Thu 5 Nov, 10:30 UTC. The Hacker News. Backdoored ARTEX Docker image exposed 62 consoles to root access.
- Thu 5 Nov, 18:00 UTC. Check Point, its first report on the story. Check Point details AI driven ARTEX cybercrime campaigns.
- Fri 6 Nov, 13:30 UTC. Infosecurity, its first report on the story. Censys finds 1,465 internet exposed ARTEX consoles.
- Sat 7 Nov, 04:00 UTC. Microsoft, its first report on the story. Storm-3358 uses ARTEX to target financial organisations.
- Sat 7 Nov, 20:30 UTC. Security Affairs, its first report on the story. Hunt.io traces ARTEX tools to breaches at South Korean banks.
- Tue 10 Nov, 22:00 UTC. Dark Reading, its first report on the story. Storm-0940 weaponises Artex AI tool to breach cloud accounts.
- Thu 12 Nov, 00:00 UTC. Unit 42, its first report on the story. Unit 42 warns attackers are using AI red teaming tools.
- Thu 12 Nov, 15:30 UTC. SOCRadar. SOCRadar Maps 916 Exposed ARTEX AI Pentest Consoles in US. This article, 17th of 18.
- Thu 12 Nov, 22:30 UTC. Dark Reading. Researchers warn AntiFox is driving attacks on AWS environments.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 18 articles as a listHide the list
- Fri 30 OctDay 01
- CrowdStrike links Vapor Panda to global AI powered intrusion campaign19:00 · The Hacker News · First report
Quiet for 2 days
Sun 1 NovDay 21- AI hacking tool ARTEX now used by cybercriminals to target finance09:20 · cybersixt
- Mon 2 NovDay 31
- North Korean groups use AI to accelerate cyber operations09:00 · SecurityOnline
- Tue 3 NovDay 43
- WorkOS data breach came from a researcher's escaped ARTEX agent00:51 · cybersixt
- Attackers Exploit CryptoPayment Gateway Flaw to Steal Wallet Keys06:30 · The Hacker News
- Chainstack Breach Exposes Customer Data and Password Hashes19:30 · The Hacker News
- Wed 4 NovDay 52
- Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts11:00 · badbyte.io
- Wiz links AI platform breaches to stolen access tokens13:30 · SecurityWeek
- Thu 5 NovDay 63
- Backdoored ARTEX Docker image exposed 62 consoles to root access10:30 · The Hacker News
- Check Point details AI driven ARTEX cybercrime campaigns18:00 · Check Point
- Fri 6 NovDay 71
- Censys finds 1,465 internet exposed ARTEX consoles13:30 · Infosecurity
- Sat 7 NovDay 82
- Storm-3358 uses ARTEX to target financial organisations04:00 · Microsoft
- Hunt.io traces ARTEX tools to breaches at South Korean banks20:30 · Security Affairs
Quiet for 3 days
Tue 10 NovDay 111- Storm-0940 weaponises Artex AI tool to breach cloud accounts22:00 · Dark Reading · Picked up again
- Thu 12 NovDay 133
- Unit 42 warns attackers are using AI red teaming tools00:00 · Unit 42
- SOCRadar Maps 916 Exposed ARTEX AI Pentest Consoles in US15:30 · SOCRadar · This article, 17th of 18
- Researchers warn AntiFox is driving attacks on AWS environments22:30 · Dark Reading