Security researchers have identified hundreds of publicly accessible instances of Artex, an open-source autonomous penetration testing tool, raising concerns that outsiders could use those deployments to conduct cyberattacks.
Web-accessible Artex instances
In a blog post, cybersecurity firm Censys said it found more than 800 distinct Artex deployments reachable from the web without password protection. Silas Cutler, principal security researcher at Censys, noted that not every exposed instance is necessarily malicious and that many are used by authorized testers. Censys said it was unclear why so many systems were configured to be internet-accessible, since Artex does not require public exposure.
Connections to recent attacks
Microsoft has described Artex as a system of AI agents that can carry out cyberattacks “from reconnaissance through data exfiltration with little needed human interaction.” Security vendors have linked Artex to several large-scale attacks. CrowdStrike attributed a September campaign against the Korean finance industry to a Chinese-speaking actor who left an “open directory” hosting an Artex instance. Censys said that particular instance appeared to have been exposed for months and contained attack data extending beyond South Korean banks.
In October, Microsoft reported that an Artex instance was used in an intrusion at IT support firm ConnectWise, which allowed Chinese-linked hackers to access data for thousands of organizations hosted in Microsoft’s cloud. Microsoft said the attackers used Artex to move into customer cloud environments and steal data at speeds that left defenders with “little time to detect and respond.”
Misconfigurations and remaining code copies
Security companies said many of the attacks tied to Artex exploited simple weaknesses, including guessed or known passwords and a lack of multi-factor authentication. Censys highlighted that publicly exposed systems can also reveal attack tools such as implants used to maintain persistent access to compromised networks.
Artex was released as open-source software in July and has since announced plans to go closed-source, limiting further releases to paid customers. Censys noted dozens of copies of Artex’s code still exist on code-sharing sites and could be reused in active attacks. Censys reported finding more than 800 web-accessible deployments and additional exposed data linked to multiple sectors.
Original source: TechCrunch AI