Criminals run autonomous ARTEX agents for broad cybercrime
Original title: Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns
Check Point found 1,608 live public consoles and ten exposed databases; one operator burned 36 billion tokens stealing signing certificates.
Check Point Research says cybercriminals are using ARTEX, a Chinese AI penetration-testing platform, to run mostly autonomous, financially motivated attacks after setting an initial goal. Researchers counted 2,557 systems that hosted ARTEX panels, 1,608 of them live and public, and ten misconfigured instances that exposed full operator databases. Chinese models, led by Deepseek Flash, dominated; one actor hit guardrails on Anthropic’s Opus 5.5 and switched models. Observed goals included stealing gray-market iOS signing certificates, cryptocurrency and gaming accounts, denial-of-service against gambling sites, and some supply-chain attacks. The developer closed the original project on October 8 after earlier use against South Korean banks, but forks remain public.
Unconfirmed: Campaign details and counts come from Check Point’s analysis of exposed consoles; the provided article cuts off mid-sentence.
- Key findings cite more than 1,800 publicly exposed ARTEX instances.
- One operator ran two consoles from October 14 to October 29 using Deepseek v4.1 Flash and Kimi K3.1 Pro.
- That certificate-theft operation processed 36 billion tokens, including 2.13 billion uncached input tokens.
- Operators commonly configured residential proxies; other frameworks seen include CyberStrike, Cairn, PentAGI and PZZ.
Impact: Certificate, account and code theft, plus supply-chain and denial-of-service attacks
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1498 Network Denial of Service
- Products
- ARTEX
- Malware
- PZZCyberStrikeCairnPentAGI
- Organizations
- Check Point Research
- Countries
- ChinaSouth Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.122.245.194 | e-20261031 . Observed update of all hosts at the same time. 103.122.245.194, .198, .199, .204, .214, .215, .216, .217, .218, .219 10 AS |
| ipv4 | 198.200.59.85 | osts ASN Country sco-fix2 38.11.173.1-125, 38.11.221.1-125, 198.200.59.85-89 255 AS54600 PEG TECH INC USA Changing tag, e.g. dev-db-r |
| ipv4 | 38.11.221.1 | : Tag IPs Total Hosts ASN Country sco-fix2 38.11.173.1-125, 38.11.221.1-125, 198.200.59.85-89 255 AS54600 PEG TECH INC USA Changing |
From the original article
13 min read at research.checkpoint.com
Key Points Introduction ARTEX is a Chinese open-source, AI-powered penetration testing platform designed to help security teams assess systems they own or are authorized to test. It uses large language models (LLMs) to coordinate multiple AI agents that plan tests, run security tools, and record evidence of potential vulnerabilities. Its web dashboard brings together assets, […]
By stcpresearch · research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.