More than 800 Artex AI hacking tool servers exposed without password
Censys identified more than 800 deployments of Artex, a Chinese-made open source tool that automates penetration testing, accessible on the web without a password. Artex was used in attacks on the Korean finance industry in September and on ConnectWise in October, according to CrowdStrike and Microsoft, and the project announced it will go closed-source. Operators should restrict access, as the tool does not need to be exposed to the internet.
What happened
Censys researchers found more than 800 servers running the Artex hacking tool open on the internet without a password. Anyone could access these copies of the tool, which automates attacks on computer systems. The project announced it will go closed-source and limit future releases to paying customers.
Why it matters
Exposed servers let outsiders use the tool to attack targets unrelated to the server owner, and expose operation data such as implants used on victims. Artex has been used in attacks on the Korean finance sector and on ConnectWise, which affected thousands of organizations, according to Microsoft and CrowdStrike. Running an open instance ties the company to malicious activity.
What to do
Check whether any Artex instances exist on your network and whether they are reachable from the internet. Restrict access, as the tool does not need exposure to run, and require passwords and multi-factor authentication wherever it runs.
For the technical team
- Affected
- Artex, ferramenta de IA para testes de penetração · More than 800 distinct Artex deployments accessible from the web, according to Censys.
- Exploitation
- Exposure reported by Censys. Artex was used in attacks on the Korean finance industry in September, attributed by CrowdStrike to a Chinese-speaking hacker who left an open directory hosting the instance, and in the October attack on ConnectWise, attributed to Chinese-linked hackers.
- Fix
- No software fix cited; mitigation is restricting instance access from the internet. The project announced it will go closed-source and limit future releases to paying customers; dozens of code copies remain on code-sharing sites and can still be used in active attacks.
- Vector
- Misconfiguration: Artex deployments accessible from the web without a password. The software does not require internet exposure to function, Censys wrote.
- More details
- Microsoft described Artex as a system of AI agents that can conduct attacks 'from reconnaissance through data exfiltration with little needed human interaction.' Per Censys, the instance used in the Korean finance attack had been publicly exposed for months and contained attack data extending well beyond South Korean banks, including payment and gaming companies. Many Artex-linked attacks exploited weak or known passwords and lack of multi-factor authentication.
Timeline
Incident opened.
Sources 1 source
- Hundreds of Artex AI hacking tools found publicly exposed to the web TechCrunch Security
