More than 800 exposed systems with Artex tool found online — TechCrunch

Cybersecurity researchers have discovered more than 800 deployments of Artex, a Chinese-made AI tool for automated vulnerability testing of computer systems, that were accessible via the internet without a password. TechCrunch reports, citing Censys, a company that scans the internet to find exposed and vulnerable systems.

Password-free access

Artex is open-source software that can be downloaded for free and run on users’ own servers following its public release in July. Microsoft previously described Artex as a system of AI agents capable of carrying out cyberattacks from reconnaissance to data theft with minimal human intervention.

Censys principal security researcher Silas Cutler said that not all exposed Artex instances are used maliciously: some may be used by authorized security testing specialists. At the same time, the software does not require open internet access to operate, so the reason why hundreds of systems are publicly accessible remains unclear.

Exposed deployments may also contain attack tools, including covert malware used to compromise networks and maintain access to them.

More current news is available on the UA.News Telegram channel Telegram.

Links to cyberattacks

Cybersecurity companies have linked Artex to several large-scale cyberattacks. In particular, CrowdStrike linked attacks on South Korea’s financial sector in September to a hacker who communicates in Chinese. According to Censys, an Artex instance involved in this campaign remained exposed for several months and likely contained data on attacks not only against South Korean banks but also against payment and gaming companies.

Artex was also used during an attack on IT support provider ConnectWise earlier in October. Microsoft said that China-linked hackers used the tool to infiltrate customers’ cloud environments and steal data, leaving defenders little time for detection and response.

Many attacks linked to Artex exploited simple vulnerabilities: weak or known passwords and the absence of multi-factor authentication. Artex developers announced a shift to a closed distribution model for paying customers, but dozens of copies of the software’s code are still available on code-sharing platforms.