Hundreds of Artex AI hacking tools found publicly exposed to the web

Summary

• Security researchers discovered hundreds of publicly exposed copies of Artex, a Chinese-made AI hacking tool accessible without passwords.
• Artex is an open-source autonomous penetration testing tool released in July that automatically probes systems for weaknesses.
• Microsoft describes Artex as a system of AI agents capable of conducting cyberattacks from reconnaissance to data exfiltration with minimal human interaction.
• Censys identified more than 800 distinct deployments of Artex accessible from the web.
• Silas Cutler of Censys noted that while some instances are used by authorized testers, the reason for hundreds of systems being exposed remains unclear.
• Publicly accessible Artex instances expose attack tools like implants used to compromise networks.
• CrowdStrike linked Artex to broad-scale cyberattacks against the Korean finance industry in September attributed to a Chinese-speaking hacker.
• Censys data indicated the Artex instance used in the Korean attacks was exposed for months and contained data extending beyond banks to payment and gaming companies.
• Artex was used in an October attack on ConnectWise allowing Chinese-linked hackers to spy on thousands of organizations in Microsoft's cloud.
• Microsoft stated hackers used Artex to steal data at a speed that left defenders little time to detect or respond.
• Many attacks linked to Artex exploited simple vulnerabilities such as weak passwords and a lack of multi-factor authentication.
• Artex announced it would transition to closed-source, limiting future releases to paid customers.
• Dozens of copies of Artex's code remain available on code-sharing sites for active use.