VULNpocalypse
HighBreach / campaignOngoing

ARTEX AI pentest operators exposed their own servers, revealing an agentic hacking campaign against South Korean banks

Operators of the China-made ARTEX AI pentest framework left servers open, exposing Claude Code and DeepSeek-driven tooling tied to breaches at seven South.

Published
Updated
Exploitation
Yes. CrowdStrike tied ARTEX-driven activity to data breaches at seven South Korean financial institutions in late Sep, early Oct 2026, and Microsoft observed agentic AI tooling exfiltrating secrets from Azure Key Vault within five minutes of finding exposed GitHub credentials

What happened

  • ARTEX is an open-source, LLM-driven autonomous penetration-testing framework developed in China and licensed under AGPL-3.0. It was published to GitHub as Autumn-27/ARTEX on 26 July 2026 by a developer who also wrote the asset-discovery platform ScopeSentry (Censys; Hunt.io).
  • Its architecture uses a Planner that turns goals into attack “intents” and Worker agents that run tools (including nmap) and write results back, over a Go backend, a Next.js console and a PostgreSQL database. It supports Anthropic, OpenAI or any OpenAI-compatible model endpoint, so providers can be swapped without rebuilding the workflow (Censys).
  • After CrowdStrike’s report, the author denied involvement on 8 October 2026, said ARTEX was meant for authorized testing, and took the repository closed-source on 11 October 2026; archived copies, forks and rebrands such as ScopeWeaver still circulate (Censys; Hunt.io).
  • Because operators left staging and working files in open directories accessible over HTTP, researchers recovered the AI models, routing scripts, credentials and exploits behind the activity, the servers exposed themselves (Hunt.io).

The South Korean bank campaign

  • CrowdStrike (published 7 October 2026) assessed with moderate confidence that a single Chinese-speaking, financially motivated individual, not an established threat group, ran the activity; Genians Security Center (published 12 October 2026) also attributed it to ARTEX (Hunt.io).
  • Seven South Korean financial institutions had data breached between late September and early October 2026, affecting approximately 66,000 to 67,000 individuals and about 2,200 corporations; stolen data included personal, employment, income and loan-related information (Hunt.io). CrowdStrike described a breach of a broker-facing loan-inquiry service at one bank and an employee mobile system at another (Censys).
  • The AI harness was Claude Code (base version 2.1.221, with 510 recorded startups since 4 August 2026), but it was not communicating directly with Anthropic, requests were routed through Claude Code Router and the xcai[.]pro reseller to DeepSeek, with GLM (Zhipu AI) and Grok as backups. CrowdStrike cited DeepSeek v4.1-flash as the primary model (Hunt.io; Cyber Security News).
  • A recovered Hong Kong jump host held a .secrets credentials file (SSH jump access, a Zhipu AI key, an OpenAI-compatible relay key and Webshare proxy access), reverse-SSH tunnel and memory-sync scripts run against a root account, and 19 custom Claude Code “skills” invoked 147 times covering recon, web injection, WAF bypass, APK decompilation, cloud-phone control and payment-logic testing (Hunt.io; Cyber Security News).
  • Recovered artifacts also included a JNDI/LDAP remote-code-execution rig with a DNS-callback confirmation, a rotating proxy that yielded 79 unique exit IPs from its first 100 identities, cryptocurrency-exchange admin and withdrawal code, and iOS/Android tooling, though Hunt.io says the link between that extra tooling and the bank breaches is unconfirmed (Hunt.io).

The Azure Key Vault / exposed-secrets campaign

  • Microsoft (published 5 November 2026) observed threat actors using agentic AI offensive tooling, naming ARTEX as an example, to search public GitHub repositories for exposed secrets, with activity beginning in August 2026. Microsoft did not name a threat actor for this activity (Microsoft; GBHackers).
  • In one case an agent went from searching GitHub for client secrets to exfiltrating data from Azure Key Vault in five minutes; the agents adapted to failed API calls rather than stopping (for example, a Key Vault batch rerun succeeded about 28 seconds after a failed request) (Microsoft).
  • Stolen application credentials were used to sign in to Microsoft Entra ID tenants from 28 October 2026, reaching storage account keys, App Service settings, connection strings, AI/ML connections, AKS credentials, SharePoint/OneDrive data and Microsoft Graph, with Azure Run Command abused on VMs. Some compromised credentials belonged to vendor-operated multitenant apps, extending exposure to downstream customers (Microsoft; GBHackers).
  • GBHackers cautions that Microsoft previously documented ARTEX use by the China-aligned Storm-0940 during a ConnectWise compromise, but warns this should not be automatically applied to the credential-theft activity (GBHackers).

Scale of exposure

  • Censys counted 1,465 internet-facing hosts exposing ARTEX consoles (as of 3 to 4 November 2026). About 650 sit in two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments; 155 hosts (10.6%) ran at least one other Censys-detected threat (Cyber Security News; Censys).
  • Co-located tooling included other AI attack frameworks (CyberStrikeAI on 70 hosts, PentAGI, HexStrike AI, RedAmon) and C2/tunneling software (Cobalt Strike, Adaptix C2, Vshell, FRP, Gophish) (Censys; Cyber Security News).
  • 32 open directories on ARTEX hosts exposed Windows lateral-movement kits, a public sudo exploit (CVE-2021-3156), Linux implants, reverse-shell scripts, compiled stagers, and in one case an operator’s home directory with .ssh material and shell history. Directories are short-lived, 10 closed and 15 appeared elsewhere between 3 and 5 November 2026 (Censys; Cyber Security News).
  • Censys stresses the 1,465 count does not mean 1,465 separate hacking groups, and public exposure alone does not prove malicious use, since authorized testers also run ARTEX (Cyber Security News; Censys).

IOCs

South Korea campaign (Hunt.io; Censys):

  • IPs: 38.244.50[.]120 (ARTEX console host, open directory); 23.248.226[.]250 (Hong Kong jump host, open directories); 154.201.79[.]246 (rotating proxy).
  • CrowdStrike-reported proxies: 101.53.80[.]20, 205.214.59[.]31, 124.155.252[.]63, 154.201.79[.]246, 23.248.249[.]90, 23.158.220[.]98, 103.248.148[.]84, 203.160.133[.]172, 209.209.85[.]38.
  • Domains: xcai[.]pro (AI reseller), direct.xcai[.]pro (routing endpoint), fofoapi[.]com (third-party FOFA API), u6ud2s.dnslog[.]cn (DNS callback).
  • TLS cert SHA-256 (issuer org “ARTEX”): C7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842.
  • HTTP title: ARTEX - 自主渗透测试控制台.

Azure / exposed-secrets campaign (Microsoft):

  • IPs: 199.19.77[.]84 (service-principal sign-ins, ARM operations); 199.19.77[.]18 (second sign-in source, Tor exit node); 65.87.223[.]26 (shell commands in user agent, App Service token theft); 157.22.126[.]128 (recon against Azure AI workloads).

Censys detection signals (Censys): page title beginning “ARTEX” plus Next.js _next/static assets; console ports 8787 (default), 8790, 443, 80; hosting ranges 38.11.221[.]0/24, 38.11.173[.]0/24, 156.234.0[.]0/16. Storm-0940 infrastructure (Microsoft, via Censys): 144.172.64[.]60, 144.172.64[.]99, 144.172.64[.]128.

What to do

  • Rotate every secret ever committed to code, not just the exposed credential, deleting repository content does not invalidate it. Rotate anything reachable through a compromised vault (Microsoft; GBHackers).
  • Enable GitHub secret scanning and push protection, and investigate service-principal sign-ins, Key Vault reads, storage downloads, Graph activity and application-credential changes (Microsoft).
  • Move to managed identities or workload identity federation and enforce least-privilege permissions on service principals (Microsoft; GBHackers).
  • Hunt for ARTEX signatures in your own estate and correlate infrastructure matches with authentication logs, endpoint activity and network connections rather than treating every console as hostile; check for nearby open directories, tunneling services and unfamiliar LLM gateways (Cyber Security News; Censys).

Sources