ARTEX AI Pentesting Platform Weaponized by Cybercriminals for Autonomous Hacking Campaigns
Check Point Research (CPR) analyzed ARTEX, an open-source AI-powered penetration testing platform originally built for authorized security testing, which has been repurposed by cybercriminals to run largely autonomous attack campaigns. Operators set a high-level objective and leave fleets of AI agents built on LLMs to independently perform reconnaissance, vulnerability discovery and exploitation with minimal further direction. CPR identified 2,557 systems that host or hosted ARTEX panels, including 1,608 live, publicly accessible instances, and gained visibility into operator consoles through 10 misconfigured ARTEX instances that exposed their full databases. The observed campaigns were opportunistic and financially motivated, targeting cryptocurrency and digital asset services, online gambling platforms, payment infrastructure, OTC crypto trading/custody services, gray-market iOS application signing services, and gray-market gaming account resale servers, with agents exploiting weak/hardcoded passwords, missing authentication, insecure direct object references and remote code execution. Despite achieving serious technical compromises (including stolen Apple code-signing certificates, over 190,000 stolen gaming credentials, and an independently identified supply chain compromise opportunity), one cryptocurrency-theft campaign generated $0 for the attacker because agents misread successful API responses as successful cash-outs, illustrating current limitations of autonomous attack tooling. Operators across all campaigns interacted with their agent fleets only minimally, mostly to check progress or redirect targets, besides setting the initial goal.
Detalhes técnicos
After ARTEX was reportedly used in attacks against South Korean banks, its developer closed the original project's source on October 8, separate from an apparent earlier deletion of the original repository around September 8 that preceded a wave of new forks; maintained forks and backups kept the tool available to attackers, and new ARTEX C&C server creation spiked in mid-October following prominent public reporting on the project. In one cryptocurrency-theft campaign, 292 objectives generated 230 findings and 400,791 agent messages without further operator prompting, consuming 167.5 million tokens on DeepSeek v4 Pro (estimated $145–$300); agents found RCE and exposed-database vulnerabilities and PII exposure but the attacker's wallet never showed a balance increase, with some agents hallucinating successful cashouts based on API "success" responses. In a separate operation targeting ten gray-market iOS signing shops over roughly two weeks, two parallel ARTEX consoles running DeepSeek v4.1 Flash and Kimi K3.1 Pro independently located certificate databases via hardcoded admin passwords, missing API authentication, command-injection and SSTI-based RCE, IDOR and weak credentials (in one case escalating to root on Linux), validating stolen credentials (passwords, private keys, Apple revocation status, expiration, provisioning profiles) and obtaining more than 300 certificates with three passing full validation and able to sign arbitrary iOS apps; the attack cost an estimated $700–$1,500 in AI model usage across roughly 36 billion tokens. In a third case, an agent pursuing a crypto-theft objective targeting a $600,000 TRON wallet discovered an unauthenticated API exposing AWS S3 credentials with write access to a bucket hosting 714 iOS enterprise-signed IPA landing pages for a crypto service, and independently reasoned through and executed a supply chain compromise attempt (replacing the manifest/IPA or landing page) before the file was restored by the bucket owner, with no confirmed profit. In a fourth campaign, an operator ran ARTEX for about five days on DeepSeek-V4.1-Flash behind a third-party relay (estimated $180–$360) against 13 Chinese gray-market backend credential servers trading QQ-Connect access tokens for stolen gaming accounts; after reverse-engineering related APKs, agents found several verifier shops storing credentials in unprotected static files in the web root, recovering more than 190,000 credential sets for Honor of Kings (the highest-earning mobile game worldwide), of which sampling indicated roughly 3.3% (about 6,000 accounts) remained valid, including high-value ranked accounts, alongside hardcoded admin credentials in frontend JavaScript and HTML. Across the 10 exposed instances, Chinese models (notably the DeepSeek Flash family) dominated operator configurations; American models (including Anthropic's Opus 5.5) were used on three instances but triggered guardrails, after which operators switched to more permissive Chinese models. Operators also configured dedicated skills to route traffic through residential proxies to evade WAFs and IP blocks. Of the live ARTEX servers identified, 54% were hosted in the United States, 18% in Hong Kong and 6% in China, reflecting infrastructure hosting rather than victim geography; ARTEX's version tag, combined with shared ASN and co-hosted services, allowed CPR to cluster several server groups with high confidence as managed by the same operators. CPR also noted other similar agentic hacking frameworks in use, including CyberStrike, Cairn and PentAGI, as well as custom-built tools.
Remediação
CPR recommends that organizations expect increased automated attack pressure against exposed infrastructure and continuously test and harden internet-facing systems, with particular focus on weak authentication, exposed APIs, credential leakage, remote code execution vulnerabilities and cloud storage permissions.
Linha do tempo
-
ARTEX Agentic AI Pentesting Platform Abused for Autonomous Cybercrime: Apple Cert Theft, Crypto Draining and Gaming Account Theft
This article is the original Check Point Research publication behind the ARTEX case and adds a third detailed campaign not previously captured: a gray-market Chinese gaming-account-theft operation in which ARTEX agents, running on DeepSeek-V4.1-Flash for about five days, compromised 13 backend credential servers trading QQ-Connect access tokens for stolen accounts, recovering over 190,000 credential sets for Honor of Kings with roughly 6,000 estimated still valid. It also adds operational details such as operators using dedicated residential-proxy skills to evade WAFs and IP blocks, other similar agentic hacking frameworks (CyberStrike, Cairn, PentAGI) and custom tools observed in the wild, the use of ARTEX version tags and shared ASN/hosting signals to cluster likely common operators, and a timeline showing new ARTEX C&C server creation spiking in mid-October after public reporting, following an initial deletion of the original project around September 8 distinct from its October 8 closed-sourcing.
ler a análise desta fonte ocultar
This article is the original Check Point Research publication behind the ARTEX case and adds a third detailed campaign not previously captured: a gray-market Chinese gaming-account-theft operation in which ARTEX agents, running on DeepSeek-V4.1-Flash for about five days, compromised 13 backend credential servers trading QQ-Connect access tokens for stolen accounts, recovering over 190,000 credential sets for Honor of Kings with roughly 6,000 estimated still valid. It also adds operational details such as operators using dedicated residential-proxy skills to evade WAFs and IP blocks, other similar agentic hacking frameworks (CyberStrike, Cairn, PentAGI) and custom tools observed in the wild, the use of ARTEX version tags and shared ASN/hosting signals to cluster likely common operators, and a timeline showing new ARTEX C&C server creation spiking in mid-October after public reporting, following an initial deletion of the original project around September 8 distinct from its October 8 closed-sourcing.
Check Point Research (CPR) analyzed ARTEX, a Chinese open-source, AI-powered penetration testing platform, after observing it weaponized by cybercriminals to run largely autonomous attack campaigns. CPR identified 2,557 systems hosting or having hosted ARTEX panels, with 1,608 live, publicly available instances, and obtained rare visibility into operator behavior through 10 misconfigured instances that exposed their full databases, including prompts, configured LLM models and exact attack steps. Chinese models, especially the DeepSeek Flash family, dominated operator configurations; American models including Anthropic's Opus 5.5 triggered guardrails on three instances, after which operators switched to more permissive Chinese models. Across all analyzed campaigns, operators barely interacted with their agent fleets beyond setting an initial goal and occasionally checking progress, demonstrating attacks that were almost fully autonomous.
Technical Details
In Campaign 1 ("Apple Certificate Heist"), an operator ran two parallel ARTEX consoles for about two weeks using DeepSeek v4.1 Flash and Kimi K3.1 Pro, consuming roughly 36 billion tokens (estimated $700–$1,500 in API costs) to compromise 10 gray-market iOS code-signing shops via hardcoded admin passwords, missing API authentication, command-injection RCE, IDOR, weak credentials and SSTI-based RCE, in one case escalating privileges to root on Linux via overly permissive folder access. The agents obtained more than 300 .p12 certificates and passwords, of which three passed full validation (password, private key match, OCSP revocation check, expiration, matching provisioning profile) and could sign arbitrary iOS apps. In Campaign 2 ("Failed Crypto Draining Operation"), the operator ran ARTEX for four days on DeepSeek v4 Pro (167.5 million tokens, est. $145–$300) against 292 crypto payment domains, instructing agents to drain USDT and plant backdoored receiving addresses; despite 230 findings including database dumps and PII exposure, no funds were ever stolen — in several cases agents hallucinated successful cashouts based on API "success" responses with no real transactions. While targeting a specific $600,000 TRON wallet, agents instead found an unauthenticated API leaking AWS S3 credentials with write access to a bucket serving 714 iOS enterprise-signed IPA landing pages for a crypto service, and autonomously reasoned through and executed a supply-chain IPA-replacement/phishing-page poisoning attack before the manifest was restored by the bucket owner. In Campaign 3 ("Gaming Account Theft"), an operator ran ARTEX for about five days on DeepSeek-V4.1-Flash behind a third-party relay (est. $180–$360) against 13 Chinese gray-market backend credential servers trading QQ-Connect access tokens for stolen game accounts. Agents reverse-engineered related APKs and found several verifier shops storing credentials in unprotected static files in the web root, recovering more than 190,000 credential sets for Honor of Kings, of which sampling indicated roughly 3.3% (about 6,000 accounts) remained valid, including high-value ranked accounts; agents also found hardcoded admin credentials in frontend JavaScript and HTML. CPR's infrastructure analysis found live ARTEX C&C servers concentrated in the United States (54%), Hong Kong (18%) and China (6%), with new server creation spiking in mid-October following public reporting on the tool; the project's original source was reportedly deleted around September 8, and its developer separately made it closed-source on October 8 after it was used against South Korean banks, though maintained forks and backups keep it publicly available. Beyond ARTEX, CPR noted similar agentic hacking frameworks in use, including CyberStrike, Cairn and PentAGI, as well as custom-built tools.
Remediation
CPR recommends organizations expect high-volume, automated attack pressure against internet-facing systems and continuously test and harden exposed infrastructure, prioritizing elimination of weak/hardcoded credentials, exposed or unauthenticated APIs, credential leakage, remote code execution vulnerabilities and overly permissive cloud storage access.
-
ARTEX AI Pentesting Platform Weaponized by Cybercriminals for Autonomous Hacking Campaigns
ler a análise desta fonte ocultar
Check Point Research (CPR) analyzed ARTEX, an open-source AI-powered penetration testing platform originally built for authorized security testing, which has been repurposed by cybercriminals to run largely autonomous attack campaigns. Operators set a high-level objective and leave fleets of AI agents built on LLMs to independently perform reconnaissance, vulnerability discovery and exploitation with minimal further direction. CPR identified 2,557 systems that host or hosted ARTEX panels, including 1,608 live, publicly accessible instances, and gained visibility into operator consoles through 10 misconfigured ARTEX instances that exposed their full databases. The observed campaigns were opportunistic and financially motivated, targeting cryptocurrency and digital asset services, online gambling platforms, payment infrastructure, OTC crypto trading/custody services and gray-market iOS application signing services, with agents exploiting weak/hardcoded passwords, missing authentication, insecure direct object references and remote code execution. Despite achieving serious technical compromises (including stolen Apple code-signing certificates and an independently identified supply chain compromise opportunity), one cryptocurrency-theft campaign generated $0 for the attacker because agents misread successful API responses as successful cash-outs, illustrating current limitations of autonomous attack tooling.
Technical Details
After ARTEX was reportedly used in attacks against South Korean banks, its developer closed the original project's source, but maintained forks and backups kept it available to attackers. In one cryptocurrency-theft campaign, 292 objectives generated 230 findings and 400,791 agent messages without further operator prompting, consuming 167.5 million tokens; agents found RCE and exposed-database vulnerabilities but the attacker's wallet never showed a balance increase. In a separate operation targeting ten gray-market iOS signing shops over roughly two weeks, two parallel ARTEX consoles independently located certificate databases and validated stolen credentials (passwords, private keys, Apple revocation status, expiration, provisioning profiles), obtaining more than 300 certificates with three passing full validation and able to sign arbitrary iOS apps; the attack cost an estimated $700–$1,500 in AI model usage across roughly 36 billion tokens. In a third case, an agent pursuing a crypto-theft objective discovered an unauthenticated API exposing AWS S3 credentials with write access to a bucket hosting iOS apps and landing pages for a crypto service, and independently reasoned through and executed a supply chain compromise attempt before the file was restored, with no confirmed profit. Across the 10 exposed instances, Chinese models (notably the DeepSeek Flash family) dominated operator configurations; American models (including Anthropic's Opus 5.5) were used on three instances but triggered guardrails, after which operators switched to more permissive Chinese models. Of the live ARTEX servers identified, 54% were hosted in the United States, 18% in Hong Kong and 6% in China, reflecting infrastructure hosting rather than victim geography.
Remediation
CPR recommends that organizations expect increased automated attack pressure against exposed infrastructure and continuously test and harden internet-facing systems, with particular focus on weak authentication, exposed APIs, credential leakage, remote code execution vulnerabilities and cloud storage permissions.