Hundreds of Exposed Artex AI Hacking Tools Found Publicly Accessible Online

Overview

Security researchers have discovered hundreds of instances of a Chinese-made AI hacking tool, known as Artex, that are publicly exposed to the internet, allowing anyone to access them and potentially launch cyberattacks against unsuspecting targets.

What Is Artex?

Artex is an open-source autonomous penetration testing tool—software that automatically probes computer systems for weaknesses. Since its public release in July, it has been linked to several cyberattacks. As open-source software, it is free for anyone to download and run on their own servers, making it a popular choice for those who cannot access the most advanced cybersecurity AI models from Anthropic or OpenAI for discovering security vulnerabilities. Microsoft has previously described Artex as a system of AI agents capable of conducting cyberattacks "from reconnaissance through data exfiltration with little needed human interaction."

Scope of Exposure

In a blog post, cybersecurity firm Censys, which scans the internet for exposed or vulnerable systems, reported that it identified more than 800 distinct deployments of Artex that were accessible from the web without requiring a password to log in.

Silas Cutler, principal security researcher at Censys and author of the blog post, noted that not every instance of Artex is operated maliciously, and many are used by authorized testers. However, it remains unclear why hundreds of these Artex systems are exposed to the web, as the software does not require internet accessibility.

Implications of Misconfiguration

The findings underscore how even powerful hacking tools can be misconfigured to be publicly accessible by anyone, increasing the risk that someone will find and misuse them. The publicly accessible systems also expose attack tools, such as implants—hidden malicious software used to compromise and maintain persistent access to a victim's network.

Links to Cyberattacks

Security companies have linked Artex to several broad-scale cyberattacks, including one against the Korean finance industry in September. Cybersecurity giant CrowdStrike attributed those attacks to a Chinese-speaking hacker who used an Artex instance, partly because the hacker had left an "open directory" hosting the system. Censys said its data showed the Artex instance in question had been publicly exposed for months and appeared to contain more attack data extending "well beyond South Korean banks," including payment and gaming companies.

Artex was also used in an attack on IT support giant ConnectWise earlier in October, which allowed Chinese-linked hackers to spy on thousands of organizations whose data and files are hosted in Microsoft's cloud. Microsoft, which has visibility into the attack, said in a blog post that the hackers used Artex to break into customers' cloud environments and steal data at such speed that defenders had "little time to detect and respond."

Many of the attacks linked to Artex involved exploiting simple vulnerabilities, such as guessing weak or known passwords and a lack of multi-factor authentication.

Simple Vulnerabilities Expose Both Attackers and Targets

The findings show that simple vulnerabilities, including misconfigurations, can expose both the attacker and their targets.

Artex Goes Closed-Source

Artex has since announced it would go closed-source, effectively limiting further releases to paid customers. However, dozens of copies of Artex's code remain available on code-sharing sites and can still be used in active attacks.

via TechCrunch AI