Security researchers have identified more than 800 distinct deployments of Artex, a Chinese-made autonomous penetration testing tool, that are publicly accessible on the internet without password protection. The software, which automatically probes computer systems for weaknesses, has been linked to several cyberattacks since its release in July. Because the tool is open-source, it is available for anyone to download and run on private servers, though Censys reported that hundreds of instances are currently exposed to the web despite the software not requiring internet accessibility.
Silas Cutler, a principal security researcher at Censys, noted that while many instances are used by authorized testers, it remains unclear why so many are left exposed. These public deployments can reveal sensitive attack tools, such as implants used to maintain persistent access to a victim's network. The exposure of these systems increases the risk that unauthorized actors will find and misuse the tools to launch cyberattacks.
CrowdStrike attributed a series of attacks against the South Korean finance industry in September to a Chinese-speaking hacker using an Artex instance. The hacker reportedly left an "open directory" hosting the system, which Censys said had been publicly exposed for months and contained data involving payment and gaming companies alongside South Korean banks. Many of these attacks exploited simple vulnerabilities, such as weak passwords or a lack of multi-factor authentication.
In October, Artex was also utilized in an attack against IT support provider ConnectWise. Microsoft reported that hackers used the tool to breach customer cloud environments and steal data at a speed that left defenders with "little time to detect and respond." The breach allowed Chinese-linked hackers to spy on thousands of organizations with data hosted in Microsoft's cloud.
Artex has since announced a transition to a closed-source model, which will limit further releases to paid customers. However, dozens of copies of the Artex code remain available on code-sharing sites, allowing the software to be used in active attacks.
