ARTEX, a Chinese open-source agentic penetration-testing platform, to run autonomous attacks.
The operators set a goal and then mostly check progress. Researchers identified 2,557 systems that host or hosted ARTEX panels, and 1,608 were live and public.
Ten misconfigured instances exposed their full databases. Those databases show the models, prompts and actions behind the campaigns.
Its developer closed the source on October 8, after CrowdStrike tied ARTEX to attacks on South Korean financial firms.
That actor used DeepSeek v4.1-flash through a likely API reseller. Forks keep the tool available. Similar frameworks include CyberStrike, Cairn and PentAGI, which has more than 33,000 GitHub stars.
Chinese models dominate, led by the DeepSeek Flash family. Guardrails triggered only on Anthropic’s Opus 5.5, and that operator then switched to more permissive Chinese models. Operator prompts were mostly “what is the progress?” requests.
One operator ran two consoles from October 14 to 29 on DeepSeek v4.1 Flash and Kimi K3.1 Pro. The run consumed 36 billion tokens, costing an estimated $700 to $1,500.
The target was 10 gray-market signing shops that sell .p12 certificates, which let buyers sideload iOS apps outside the App Store.
A USENIX Security 2026 study mapped this market. It found 3,359 active signing sites and resale margins up to 3,000%.
Check Point Researchers said that, ARTEX uses large language models to coordinate agents that plan tests, run security tools and record evidence.
Gaming Accounts Targeted
Agents broke in through hardcoded admin passwords in JavaScript bundles, missing API authentication, command-injection and SSTI remote code execution, IDOR flaws and weak credentials.
One host also fell to a Linux privilege escalation to root. The agents collected more than 300 certificates with passwords.
They validated each by decrypting the key, matching the private key to the certificate, checking Apple’s OCSP revocation status, checking expiry and looking for an In-House provisioning profile. Only three passed.
The number of newly created ARTEX C&C servers spiked in mid-October, coinciding with prominent public reporting about the project.
A second operator tasked agents with draining USDT from 292 crypto payment domains and swapping in the attacker’s receiving address.
Across 230 findings and 400,791 agent messages, no money moved. Some agents reported successful cashouts based only on API “success” responses, and the attacker’s wallet stayed at zero.
One agent did find an unauthenticated API leaking AWS S3 credentials. That gave write access to a bucket holding 714 iOS enterprise-signed landing pages.
The agent rewrote a manifest to stage a supply chain attack, but the owners later restored it.
A third operator pointed agents at 13 backend credential servers in China’s gray market for hacked game accounts. Those accounts need only a QQ-Connect access token, not a password.
Over about five days on DeepSeek-V4.1-Flash, at an estimated $180 to $360, agents found a 21.5 MB plaintext credential file in a web root.
They recovered more than 190,000 Honor of Kings credential sets. About 3.3% were still valid, which is roughly 6,000 accounts. The campaign relied on breadth and persistence rather than sophisticated exploits.
Most live ARTEX servers sit in the US (882, 54%), Hong Kong (295, 18%) and China (103, 6%). New command-and-control servers spiked in mid-October.
Version tags link three likely operator clusters: 255 hosts on AS54600 PEG TECH using the tag sco-fix2, 10 Thai hosts on AS152918, and 5 hosts on AS36352 HostPapa.
The agents succeeded through basic web flaws, not novel exploits. Defenders should remove hardcoded credentials from front-end bundles and enforce API authentication.
They should also avoid storing plaintext secrets in web roots and restrict S3 write permissions. Exposed ARTEX administrative panels are also worth hunting for.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
