Skip to content
NewA calmer, faster ZeroHour
Researchlow

ARTEX AI hacking framework found on 1,465 public servers

Original title: ARTEX AI Hacking Framework Found on 1,465 Public Servers, Some Hosting Cyberattack Tools

Cyber Security Newsby Tushar Subhra Dutta ()3 min read3
Read at cybersecuritynews.com
AI summary · x-ai/grok-4.7Summaries by Vani AI

Censys researchers found ARTEX, an AI-powered penetration-testing framework, on 1,465 internet-facing hosts, some also hosting attack tools.

Security researchers from Censys discovered ARTEX exposed on 1,465 public servers. The framework combines a Go backend, Next.js console, and PostgreSQL database, using AI agents for automated penetration testing. Some hosts co-hosted with C2 tools such as Cobalt Strike and phishing software. Defenders should check for exposed directories containing tools and implants.

Unconfirmed: Some servers may host cloned systems or unauthorized use

Key facts
  • 1,465 exposed hosts, 650 in repeated configurations
  • 155 hosts with additional threat detections
  • Co-hosted tools include Vshell, Cobalt Strike, and Gophish
  • Links to past attacks on South Korean financial institutions
  • Exposed directories contain Windows tools, implants, and operator files
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
ai-hackingframeworkcensysexposure
Victims
South Korean financial institutions
Organizations
Censys
Countries
USSouth Korea

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domainxcai.pro209.209.85[.]38 Reported proxy infrastructure LLM reseller xcai[.]pro Reported API reseller Microsoft infrastructure 144.172.64
ipv4101.42.4.91ure Co-hosted attack tools 1.14.104[.]208 , 1.14.193[.]53 , 101.42.4[.]91 , 192.210.193[.]156 ARTEX with C2 or tunneling services M
ipv4101.53.80.200[.]120 Framework and exposed directory CrowdStrike proxies 101.53.80[.]20 , 205.214.59[.]31 , 124.155.252[.]63 , 154.201.79[.]246 ,
ipv4103.248.148.8463 , 154.201.79[.]246 , 23.248.249[.]90 , 23.158.220[.]98 , 103.248.148[.]84 , 203.160.133[.]172 , 209.209.85[.]38 Reported proxy infr
ipv4104.250.149.210[.]14 ARTEX, CyberStrikeAI, ARL, Vshell Customized consoles 104.250.149[.]210 , 104.250.149[.]211 , 104.250.149[.]212 , 104.250.149[.]2
ipv4104.250.149.211rikeAI, ARL, Vshell Customized consoles 104.250.149[.]210 , 104.250.149[.]211 , 104.250.149[.]212 , 104.250.149[.]213 ARTEX MX hosts Ex
ipv4104.250.149.212Customized consoles 104.250.149[.]210 , 104.250.149[.]211 , 104.250.149[.]212 , 104.250.149[.]213 ARTEX MX hosts Exposed directories 11
ipv4104.250.149.213104.250.149[.]210 , 104.250.149[.]211 , 104.250.149[.]212 , 104.250.149[.]213 ARTEX MX hosts Exposed directories 110.42.215[.]163:18080
ipv4108.165.147.226directories 110.42.215[.]163:18080 , 111.68.4[.]13:18080 , 108.165.147[.]226:8299 , 206.187.215[.]173:8081 , 181.41.194[.]136:8081 , 2
ipv4110.42.215.163]212 , 104.250.149[.]213 ARTEX MX hosts Exposed directories 110.42.215[.]163:18080 , 111.68.4[.]13:18080 , 108.165.147[.]226:8299 , 20
ipv4111.68.4.13ARTEX MX hosts Exposed directories 110.42.215[.]163:18080 , 111.68.4[.]13:18080 , 108.165.147[.]226:8299 , 206.187.215[.]173:8081 ,
ipv41.14.104.2082.64[.]128 Storm-0940 infrastructure Co-hosted attack tools 1.14.104[.]208 , 1.14.193[.]53 , 101.42.4[.]91 , 192.210.193[.]156 ARTEX
ipv41.14.193.530940 infrastructure Co-hosted attack tools 1.14.104[.]208 , 1.14.193[.]53 , 101.42.4[.]91 , 192.210.193[.]156 ARTEX with C2 or tunn
ipv4124.155.252.63tory CrowdStrike proxies 101.53.80[.]20 , 205.214.59[.]31 , 124.155.252[.]63 , 154.201.79[.]246 , 23.248.249[.]90 , 23.158.220[.]98 ,
ipv4144.172.64.128icrosoft infrastructure 144.172.64[.]60 , 144.172.64[.]99 , 144.172.64[.]128 Storm-0940 infrastructure Co-hosted attack tools 1.14.104
ipv4144.172.64.60r xcai[.]pro Reported API reseller Microsoft infrastructure 144.172.64[.]60 , 144.172.64[.]99 , 144.172.64[.]128 Storm-0940 infrastru
ipv4144.172.64.99ted API reseller Microsoft infrastructure 144.172.64[.]60 , 144.172.64[.]99 , 144.172.64[.]128 Storm-0940 infrastructure Co-hosted at
ipv4154.12.86.207.]173:8081 , 181.41.194[.]136:8081 , 203.195.243[.]103:80 , 154.12.86[.]207:18080 Exploits, implants, loaders, operator files Hosting
ipv4154.201.79.246oxies 101.53.80[.]20 , 205.214.59[.]31 , 124.155.252[.]63 , 154.201.79[.]246 , 23.248.249[.]90 , 23.158.220[.]98 , 103.248.148[.]84 ,
ipv4181.41.194.1363:18080 , 108.165.147[.]226:8299 , 206.187.215[.]173:8081 , 181.41.194[.]136:8081 , 203.195.243[.]103:80 , 154.12.86[.]207:18080 Explo
ipv4192.210.193.156tack tools 1.14.104[.]208 , 1.14.193[.]53 , 101.42.4[.]91 , 192.210.193[.]156 ARTEX with C2 or tunneling services Matching deployments
ipv4203.160.133.17246 , 23.248.249[.]90 , 23.158.220[.]98 , 103.248.148[.]84 , 203.160.133[.]172 , 209.209.85[.]38 Reported proxy infrastructure LLM resel
ipv4203.195.243.103226:8299 , 206.187.215[.]173:8081 , 181.41.194[.]136:8081 , 203.195.243[.]103:80 , 154.12.86[.]207:18080 Exploits, implants, loaders, o
ipv4205.214.59.31and exposed directory CrowdStrike proxies 101.53.80[.]20 , 205.214.59[.]31 , 124.155.252[.]63 , 154.201.79[.]246 , 23.248.249[.]90 ,
ipv4206.187.215.173]163:18080 , 111.68.4[.]13:18080 , 108.165.147[.]226:8299 , 206.187.215[.]173:8081 , 181.41.194[.]136:8081 , 203.195.243[.]103:80 , 154
ipv4209.209.85.38, 23.158.220[.]98 , 103.248.148[.]84 , 203.160.133[.]172 , 209.209.85[.]38 Reported proxy infrastructure LLM reseller xcai[.]pro Rep
ipv423.158.220.981 , 124.155.252[.]63 , 154.201.79[.]246 , 23.248.249[.]90 , 23.158.220[.]98 , 103.248.148[.]84 , 203.160.133[.]172 , 209.209.85[.]38
ipv423.248.249.900 , 205.214.59[.]31 , 124.155.252[.]63 , 154.201.79[.]246 , 23.248.249[.]90 , 23.158.220[.]98 , 103.248.148[.]84 , 203.160.133[.]172
ipv438.244.50.120Source-reported indicators Context CrowdStrike ARTEX server 38.244.50[.]120 Framework and exposed directory CrowdStrike proxies 101.5
ipv445.87.53.10ng deployments 45.87.53[.]3 , 45.87.53[.]4 , 45.87.53[.]6 , 45.87.53[.]10 , 45.87.53[.]14 ARTEX, CyberStrikeAI, ARL, Vshell Customi
ipv445.87.53.145.87.53[.]3 , 45.87.53[.]4 , 45.87.53[.]6 , 45.87.53[.]10 , 45.87.53[.]14 ARTEX, CyberStrikeAI, ARL, Vshell Customized consoles 104
ipv445.87.53.356 ARTEX with C2 or tunneling services Matching deployments 45.87.53[.]3 , 45.87.53[.]4 , 45.87.53[.]6 , 45.87.53[.]10 , 45.87.53[
ipv445.87.53.42 or tunneling services Matching deployments 45.87.53[.]3 , 45.87.53[.]4 , 45.87.53[.]6 , 45.87.53[.]10 , 45.87.53[.]14 ARTEX, Cyb
ipv445.87.53.6services Matching deployments 45.87.53[.]3 , 45.87.53[.]4 , 45.87.53[.]6 , 45.87.53[.]10 , 45.87.53[.]14 ARTEX, CyberStrikeAI, ARL

From the original article

3 min read at cybersecuritynews.com

Security researchers have found ARTEX, an AI-powered penetration-testing framework, exposed on 1,465 internet-facing hosts. Some servers also hosted command-and-control tools, phishing software, and exploit files, showing how automated security-testing platforms are appearing alongside established attack infrastructure.

Cyber Security News

By Tushar Subhra Dutta · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.