ARTEX AI Framework Exposed on 1,465 Servers Linked to Bank Breaches
Original title: ARTEX AI Framework Linked to Bank Breaches and Cloud Attacks Found Exposed Across Hundreds of Servers
The framework was used in South Korean bank breaches and ConnectWise Cloud supply-chain attacks.
ARTEX AI Framework, an LLM-driven penetration-testing platform released under AGPL-3.0 in July 2026, was found exposed on 1,465 hosts. It has been linked by CrowdStrike to breaches at South Korean financial organizations and to the ConnectWise Cloud Backup compromise. Exposed instances leak sensitive files and support reconnaissance to data exfiltration with minimal human interaction.
Unconfirmed: The Chinese-speaking operator's financial motivation was assessed by CrowdStrike with moderate confidence.
- 1,465 hosts exposed as of November 4.
- 650 hosts share standardized configurations.
- Linked to South Korean bank breaches September-October 2026.
- Used in ConnectWise Cloud supply-chain compromise.
- 32 hosts exposed post-exploitation tools and implants.
- Vendors
- Autumn-27
- Products
- ARTEXConnectWise Cloud
- Threat actors
- Storm-0940Chinese-speaking actor
- Organizations
- CrowdStrikeMicrosoftCensys
- Countries
- ChinaSouth Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 101.53.80.20 | 38.244.50[.]120 ARTEX host and open directory (CrowdStrike) 101.53.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248. |
| ipv4 | 103.248.148.84 | 5.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.209.85[.]38 Proxies (CrowdStrike) N |
| ipv4 | 124.155.252.63 | open directory (CrowdStrike) 101.53.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248. |
| ipv4 | 154.201.79.246 | rowdStrike) 101.53.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160. |
| ipv4 | 203.160.133.172 | 1.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.209.85[.]38 Proxies (CrowdStrike) Note: IP addresses |
| ipv4 | 205.214.59.31 | ARTEX host and open directory (CrowdStrike) 101.53.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158. |
| ipv4 | 209.209.85.38 | 249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.209.85[.]38 Proxies (CrowdStrike) Note: IP addresses and domains are |
| ipv4 | 23.158.220.98 | 4.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.209.85[.]38 Proxie |
| ipv4 | 23.248.249.90 | 3.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.20 |
| ipv4 | 38.244.50.120 | with data exfiltration observed. The actor’s ARTEX server, 38.244.50[.]120, used DeepSeek v4.1-flash, apparently accessed through an |
From the original article
3 min read at gbhackers.com
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is publicly exposed across 1,465 hosts. The findings show that ARTEX, an LLM-driven offensive security platform released in July 2026, appears alongside conventional attack infrastructure while leaking sensitive operational files. Censys observed the exposed consoles as of November 4, but the […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.