Censys finds 1,465 internet-exposed ARTEX AI pentest consoles, ~815 distinct deployments, after ARTEX use in South Korea and ConnectWise attacks
Researchers at Censys report that hundreds of copies of ARTEX, a Chinese-made open-source LLM-driven autonomous penetration testing framework, are reachable from the internet without authentication, exposing the operators' own attack tooling and allowing outsiders to drive the consoles against unsuspecting targets. TechCrunch cites more than 800 distinct deployments; the underlying Censys blog post "ARTEX: Agentic Asbestos" by Silas Cutler, published 5 November 2026, states 1,465 hosts running an exposed ARTEX console as of 4 November 2026, of which about 650 sit in two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments, and notes that the console does not require public-facing access (censys.com). ARTEX has been linked to real intrusions since its July 2026 release: a campaign against South Korean financial institutions reported by CrowdStrike, and the ConnectWise supply-chain compromise that Microsoft attributed to the China state-aligned actor Storm-0940. Microsoft describes ARTEX as able to run "from reconnaissance through data exfiltration" with minimal human input, and the attacks mostly abused weak or known passwords and missing multi-factor authentication rather than novel exploits. Not every exposed instance is malicious — Censys notes some exposed hosts are likely operated by authorized testers (censys.com) — but the exposure is an opportunity both for defenders hunting operators and for third parties abusing live offensive infrastructure.
Detalhes técnicos
ARTEX was published on GitHub as Autumn-27/ARTEX on 26 July 2026 under AGPL-3.0 by the author of ScopeSentry, a Chinese asset-discovery and vulnerability-scanning platform whose assets it ingests into its own graph (censys.com). It is written in Go with a Next.js console backed by PostgreSQL; a Planner agent turns an operator goal into attack "intents" and Worker agents run tools such as nmap in an explore-decide-execute loop, and it works with Anthropic, OpenAI or any OpenAI-compatible endpoint (censys.com). Censys found 155 ARTEX hosts (10.6%) also running at least one other detected threat — other AI attack frameworks, recon platforms, tunneling tools and C2 such as Vshell, Cobalt Strike and Adaptix C2 — and observed open directories on the ARTEX server named in CrowdStrike's report starting 18 August 2026, seven weeks before publication, exposing exploit binaries and a .claude folder; 32 further open directories on other ARTEX hosts expose post-exploitation kits, stagers and implants (censys.com). In the South Korea case CrowdStrike assessed a financially motivated Chinese speaker with moderate confidence; ARTEX ran on 38.244.50[.]120 with DeepSeek v4.1-flash bought through an API reseller, alongside Claude Code sessions backed by GLM and Grok, and the actor breached a broker-facing loan inquiry service at one bank and an employee mobile system at another (censys.com). For ConnectWise, Microsoft reported Storm-0940 used ARTEX to automate scanning, password spraying and OAuth application abuse, attempting sign-ins against more than 2,250 tenants, peaking at 2,900 attempts per minute, with some victims seeing privileged cloud access in under three hours (censys.com). The ARTEX author denied involvement on 8 October, the day after CrowdStrike's report, said the project would go closed-source, and the repository has since been taken down, though archived copies, translations and rebrands such as ScopeWeaver still circulate (censys.com).
Remediação
Censys detects ARTEX consoles by page title combined with Next.js static assets and labels them ARTEX / ScopeWeaver; the default console port is 8787/tcp, with 8790 and 443 also common (censys.com). Suggested pivots include co-located open directories, Vshell or FRP listeners, and self-hosted LLM proxy or reseller software such as CLIProxyAPI and New API on the same host, which are also worth investigating in egress logs (censys.com). Defenders should block and hunt for the published infrastructure, enforce multi-factor authentication, eliminate weak or reused credentials, monitor for high-rate password spraying against Microsoft 365 and Exchange Online, and audit OAuth application consents and service-provider delegated access. Operators of legitimate ARTEX or similar agentic pentest consoles should keep them off the public internet.
Linha do tempo
-
Censys finds 1,465 internet-exposed ARTEX AI pentest consoles, ~815 distinct deployments, after ARTEX use in South Korea and ConnectWise attacks
ler a análise desta fonte ocultar
Researchers at Censys report that hundreds of copies of ARTEX, a Chinese-made open-source LLM-driven autonomous penetration testing framework, are reachable from the internet without authentication, exposing the operators' own attack tooling and allowing outsiders to drive the consoles against unsuspecting targets. TechCrunch cites more than 800 distinct deployments; the underlying Censys blog post "ARTEX: Agentic Asbestos" by Silas Cutler, published 5 November 2026, states 1,465 hosts running an exposed ARTEX console as of 4 November 2026, of which about 650 sit in two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments, and notes that the console does not require public-facing access (censys.com). ARTEX has been linked to real intrusions since its July 2026 release: a campaign against South Korean financial institutions reported by CrowdStrike, and the ConnectWise supply-chain compromise that Microsoft attributed to the China state-aligned actor Storm-0940. Microsoft describes ARTEX as able to run "from reconnaissance through data exfiltration" with minimal human input, and the attacks mostly abused weak or known passwords and missing multi-factor authentication rather than novel exploits. Not every exposed instance is malicious — Censys notes some exposed hosts are likely operated by authorized testers (censys.com) — but the exposure is an opportunity both for defenders hunting operators and for third parties abusing live offensive infrastructure.
Technical Details
ARTEX was published on GitHub as
Autumn-27/ARTEXon 26 July 2026 under AGPL-3.0 by the author of ScopeSentry, a Chinese asset-discovery and vulnerability-scanning platform whose assets it ingests into its own graph (censys.com). It is written in Go with a Next.js console backed by PostgreSQL; a Planner agent turns an operator goal into attack "intents" and Worker agents run tools such as nmap in an explore-decide-execute loop, and it works with Anthropic, OpenAI or any OpenAI-compatible endpoint (censys.com). Censys found 155 ARTEX hosts (10.6%) also running at least one other detected threat — other AI attack frameworks, recon platforms, tunneling tools and C2 such as Vshell, Cobalt Strike and Adaptix C2 — and observed open directories on the ARTEX server named in CrowdStrike's report starting 18 August 2026, seven weeks before publication, exposing exploit binaries and a.claudefolder; 32 further open directories on other ARTEX hosts expose post-exploitation kits, stagers and implants (censys.com). In the South Korea case CrowdStrike assessed a financially motivated Chinese speaker with moderate confidence; ARTEX ran on38.244.50[.]120with DeepSeek v4.1-flash bought through an API reseller, alongside Claude Code sessions backed by GLM and Grok, and the actor breached a broker-facing loan inquiry service at one bank and an employee mobile system at another (censys.com). For ConnectWise, Microsoft reported Storm-0940 used ARTEX to automate scanning, password spraying and OAuth application abuse, attempting sign-ins against more than 2,250 tenants, peaking at 2,900 attempts per minute, with some victims seeing privileged cloud access in under three hours (censys.com). The ARTEX author denied involvement on 8 October, the day after CrowdStrike's report, said the project would go closed-source, and the repository has since been taken down, though archived copies, translations and rebrands such as ScopeWeaver still circulate (censys.com).Remediation
Censys detects ARTEX consoles by page title combined with Next.js static assets and labels them ARTEX / ScopeWeaver; the default console port is 8787/tcp, with 8790 and 443 also common (censys.com). Suggested pivots include co-located open directories, Vshell or FRP listeners, and self-hosted LLM proxy or reseller software such as CLIProxyAPI and New API on the same host, which are also worth investigating in egress logs (censys.com). Defenders should block and hunt for the published infrastructure, enforce multi-factor authentication, eliminate weak or reused credentials, monitor for high-rate password spraying against Microsoft 365 and Exchange Online, and audit OAuth application consents and service-provider delegated access. Operators of legitimate ARTEX or similar agentic pentest consoles should keep them off the public internet.