ARTEX AI Framework Linked to Bank Breaches and Cloud Attacks Found Exposed Across Hundreds of Servers

An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is publicly exposed across 1,465 hosts.

The findings show that ARTEX, an LLM-driven offensive security platform released in July 2026, appears alongside conventional attack infrastructure while leaking sensitive operational files.

Censys observed the exposed consoles as of November 4, but the headline count does not represent 1,465 independent operators.

Approximately 650 hosts share standardized configurations across two hosting networks, leaving roughly 815 distinct-looking deployments.

Public exposure is unnecessary for ARTEX operation, meaning the visible footprint likely understates deployment.

Published by developer Autumn-27 on July 26 under AGPL-3.0, ARTEX combines Go, a Next.js console, and PostgreSQL.

It integrates with ScopeSentry, the developer’s asset-discovery platform, importing domains, addresses, ports, and endpoints into an asset graph.

Operators define objectives and authorized scope through tasks. A Planner agent converts objectives into attack intents, while worker agents execute tools, record results, and continue an event-driven exploration loop.

Separate asset and exploration graphs track discovered infrastructure and testing progress.

The framework supports Anthropic, OpenAI, and compatible model endpoints. Microsoft describes its capabilities as extending from reconnaissance through data exfiltration with minimal human interaction.

Its integration with mitmproxy adds traffic interception and recording capabilities.

In its October 7 investigation, CrowdStrike linked ARTEX infrastructure to attacks against South Korean financial organizations during late September and early October.

Reported breaches affected a broker-facing loan inquiry service and an employee mobile work-support system, with data exfiltration observed.

The actor’s ARTEX server, 38.244.50[.]120, used DeepSeek v4.1-flash, apparently accessed through an API reseller. Exposed directories revealed Claude Code histories, prompts, and configuration files.

ARTEX AI Framework

CrowdStrike assessed with moderate confidence that the unattributed operator was financially motivated and Chinese-speaking.

Separately, Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to China-aligned Storm-0940.

Censys Researchers said that, the actor used ARTEX to accelerate reconnaissance, password spraying, and OAuth application abuse, attempting authentication against more than 2,250 customer tenants. Some intrusions reached privileged cloud access within three hours.

A related password-spraying campaign peaked at 2,900 failures per minute but produced no observed successful authentication.

Downstream application abuse instead exploited stolen application credentials and existing customer trust. Microsoft cautioned that authentication alone does not establish data theft.

Censys scan history showed open directories on the CrowdStrike-linked server from August 18, seven weeks before disclosure.

Another 32 ARTEX hosts exposed directories containing post-exploitation tools, stagers, implants, scripts, and credentials.

Across the broader dataset, 155 hosts, or 10.6%, carried another Censys threat detection. CyberStrikeAI appeared on 70; other colocated tools included Vshell, Cobalt Strike, Adaptix C2, and tunneling software.

Forty-three hosts also operated LLM gateways or reseller platforms.

These overlaps do not establish malicious ownership: authorized testers also use offensive frameworks, and repeated hosting templates can inflate infrastructure counts.

For defenders, the strongest response combines infrastructure hunting with identity investigation.

Microsoft recommends reviewing service-principal sign-ins, unexpected application credentials, privilege changes, and subsequent Microsoft Graph activity.

Preserve evidence before removing applications, investigate unauthorized persistence, and avoid treating ARTEX exposure alone as proof of compromise.

Investigators should also correlate successful authentications with resource access and directory changes, rather than relying solely on known attacker addresses or application names.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.