ARTEX's footprint reaches far past known attacks

An AI-driven offensive framework built for penetration testing is now showing up on far more systems than the handful of threat campaigns that first put it on the map. According to a Censys report published on November 5, more than a thousand hosts around the world are exposing the tool's control console to the open internet — a footprint that dwarfs the incidents researchers have publicly tied to it so far.

The tool, ARTEX, is an open-source, AI model-driven, autonomous penetration testing framework. It was released on GitHub by a user known as 'Autumn-27' in July 2026. Since October, it has been folded into several known malicious campaigns, but the Censys scan suggests its real spread is considerably wider.

What ARTEX actually is

ARTEX is written in Go and ships with an embedded Next.js web console. Functionally, it acts as an offensive command-and-control (C2) platform: it talks to several AI agents and can be plugged into large language models (LLMs). That combination — an agent console, model access, and C2 framing — is what makes the tool attractive to operators who want to automate parts of an intrusion.

The project's creator has said the software was meant only for authorized penetration testing. The original GitHub repository was taken down in October 2026, with the author claiming no involvement in the ARTEX-linked attacks. The code has continued to circulate anyway through community forks, including localized variants such as ScopeWeaver and a commercial edition called ARTEX PRO.

How the campaigns stacked up

In early October, CrowdStrike linked ARTEX to a campaign against South Korean financial institutions. Those analysts found ARTEX was used alongside Anthropic's Claude AI model during an operation that ran from late September to early October 2026. CrowdStrike assessed with moderate confidence that the attacker was a Chinese speaker and financially motivated.

Later in October, Microsoft linked ARTEX to a large-scale compromise of ConnectWise customer tenants, which led the IT management software provider to take a number of its cloud services offline. Microsoft attributed that campaign to Storm-0940, a China-state-aligned cyber threat actor also known as CovertNetwork-1658 or ORB07.

More recently, on November 4, the Indian Computer Emergency Response Team (CERT-In) warned financial and cryptocurrency organizations that a threat group tracked as 'Crafty Falcon' had been targeting them in successive attacks using several AI-powered tools, ARTEX among them.

Counting the exposed consoles

The Censys findings come from Silas Cutler, principal security researcher at the Censys Advanced Research Collective (ARC). His report found that 1465 hosts worldwide are exposing an ARTEX console to the public internet. About 650 of those sit within two blocks of identically configured hosting, leaving roughly 815 distinct-looking deployments.

That breakdown matters because it separates genuine spread from what could be boilerplate hosting. Even after discounting the clustered systems, the remaining count suggests ARTEX is not confined to a handful of isolated machines but is present across hundreds of apparently separate deployments internationally.

Censys telemetry also showed that 155 internet-exposed ARTEX hosts (10.6%) run at least one other artefact the firm categorizes as a threat. Those include other AI attack frameworks, reconnaissance platforms, tunneling tools and traditional malicious C2 servers such as Vshell, Cobalt Strike and Adaptix C2. An asset-discovery and vulnerability-scanning platform called ScopeSentry, maintained by the same creator behind ARTEX, also appears on Censys's threat list.

Overlapping tools on shared hosts

The scan found ARTEX sharing infrastructure with several other popular AI-powered penetration-testing tools, including CyberStrikeAI, PentAGI, HexStrike AI and RedAmon. CyberStrikeAI in particular appeared alongside ARTEX on 70 hosts.

"Operators appear to be using multiple agent frameworks side by side,"

— Silas Cutler, principal security researcher at the Censys Advanced Research Collective (ARC)

The Crafty Falcon campaign that CERT-In described in November fits that pattern, showing ARTEX used alongside PentAGI and CyberStrikeAI. Stacking frameworks this way gives an operator fallbacks, or lets them split tasks across different agents.

Directories left open to the internet

Censys identified 32 ARTEX hosts with publicly accessible directories holding tools used at different stages of cyber-attacks, including post-exploitation kits, stagers and implants. The presence of those materials on exposed hosts points to setups that were configured for real operations rather than testing.

The scan also turned up evidence of AI infrastructure being built into the offensive stack itself. 43 ARTEX hosts were found running self-hosted LLM gateway or reseller software. In practical terms, that means model access is being treated as just another piece of infrastructure an operator has to stand up and manage, rather than something pulled from a third-party service each time.

The numbers behind the spread

• 1465 hosts worldwide exposing an ARTEX console to the public internet
• 650 of those hosts sit within two blocks of identically configured hosting
• Roughly 815 distinct-looking deployments after accounting for clustering
• 155 hosts (10.6%) also run at least one other artefact Censys categorizes as a threat
• 70 hosts running CyberStrikeAI alongside ARTEX
• 32 hosts with publicly accessible directories containing post-exploitation kits, stagers and implants
• 43 hosts running self-hosted LLM gateway or reseller software

Cheap to run, and unreliable

Separate research from Check Point found that AI agents in ARTEX control panels are running large-scale attacks with little human input for just a few hundred dollars. The same work found the agents still fail and hallucinate successes — a caveat worth keeping in mind when weighing how much damage the framework actually delivers versus how much noise it generates.

The combination of low cost, open-source availability and easy replication through forks helps explain why the console shows up on so many hosts. A tool that can be cloned, localized and rebranded does not need a single author to stay in circulation; community forks carry it forward even after the original repository goes offline.

Why it matters

The headline number here is not the campaign count — it is the infrastructure count. If Censys's reading holds, ARTEX has moved from being a tool named in a few incident reports to something closer to a widely installed platform, and that shift has consequences for anyone running internet-facing systems. Defenders who only track named campaigns may be watching a fraction of the picture; scanning for exposed agent consoles and AI gateways is a different kind of visibility problem than hunting a specific intrusion set.

The overlap findings also complicate attribution. When the same host runs ARTEX alongside CyberStrikeAI, PentAGI or a commodity C2 like Cobalt Strike, tying an intrusion to one actor or one tool becomes harder, and the presence of a legitimate-looking penetration-testing framework on a network tells you less than it once might. For organizations in finance and cryptocurrency — the sectors CERT-In flagged — the practical takeaway is that AI-assisted tooling is now part of the baseline an attacker can reach for, not an exotic edge case. That does not mean every exposed console is active or hostile, and Censys's data alone cannot say who is behind each one. It does suggest the pool of potential operators is larger than the published campaign tally implies, and that treating the framework's spread as a containment problem may prove more useful than treating it as a single group's signature.