More Than 800 Artex AI Hacking Tool Deployments Exposed Online

Security researchers found more than 800 deployments of Artex, an AI-powered penetration-testing tool, accessible from the internet without a password. The findings were reported by Censys, a cybersecurity firm that scans for exposed systems.

Artex is an open-source tool that automatically probes computer systems for weaknesses. Censys researcher Silas Cutler said not all exposed instances are malicious; many are used by authorized testers. The reason hundreds were reachable online is unclear, since the software does not need internet access to operate.

Artex has been linked to several cyberattacks since its public release in July. In September, CrowdStrike attributed attacks on South Korea’s finance industry to a Chinese-speaking hacker who used an Artex instance. Censys said that instance had been exposed for months and appeared to contain data related to payment and gaming companies as well as South Korean banks.

Earlier in October, Artex was also used in an attack on IT support company ConnectWise. Microsoft said hackers used it to enter customers’ cloud environments and steal data quickly, leaving defenders little time to respond. Some attacks involved weak or known passwords and missing multi-factor authentication.

Artex has announced it will become closed-source, limiting further releases to paying customers. Dozens of copies of its code remain on code-sharing sites and can still be used in active attacks.