Check Point details AI driven ARTEX cybercrime campaigns

Check Point Research reports that ARTEX, an open‑source, AI‑driven “agentic hacking” platform, is being used by multiple cybercriminal operators to autonomously discover and exploit vulnerabilities at scale. The study finds more than 1,800 publicly exposed ARTEX deployments, with 1,608 live instances accessible publicly at the time of analysis, and tenmisconfigured deployments exposing full ARTEX databases.

The researchers present operator console artifacts showing which models were used and how operators prompted their agents. They note that most campaigns ran almost entirely autonomously after the initial goal was set, with little operator interaction beyond monitoring progress. Chinese language models, particularly the Deepseek Flash family, were the most common, while some instances used American models; guardrails appeared to be bypassed when using Anthropic’s Opus 5.5.

Evidence also points to extensive use of residential proxies to evade defences, and the deployment of several agentic frameworks beyond ARTEX, including CyberStrike, Cairn and PentAGI.

The article details three campaigns illustrating opportunistic, financially motivated cybercrime. Campaign 1, Apple Certificate Heist, involved compromising gray‑market signing shops to steal and resell iOS code‑signing certificates, with 36 billion tokens processed over roughly two weeks across two ARTEX consoles. Campaign 2, aFailed Crypto Draining operation, pursued USDT via three attack waves, but no funds moved to the attackers’ wallets.

Campaign 3, Gaming Account Theft, targeted credential stores for data accounts, recovering over 190,000 credentials with only about 3.3% verified as active. Across 230 findings and 400,791 agent messages, no income was observed; operators appeared focused on “passive income” rather than traditional data or access brokering. The study also maps ARTEX C&C infrastructure geographically and by version tagging, noting clustering by actor.

The researchers conclude agentic hacking tools already form part of the threat landscape, with high volumes of attacks likely to target exposed perimeters. SOURCE_UNAVAILABLE