ARTEX AI tool used in more campaigns than reported, Censys finds
Original title: ARTEX Offensive AI Tool Activity Far Exceeds Reported Campaigns, Censys Finds
Censys analysis reveals 1465 exposed ARTEX consoles worldwide, with 10.6% also running other threat artefacts.
An open-source AI-driven penetration testing framework called ARTEX, released on GitHub in July 2026, has been linked to campaigns targeting South Korean financial institutions and large-scale compromises of ConnectWise tenants. Microsoft attributed one operation to Storm-0940, while CrowdStrike found it alongside Anthropic's Claude model in attacks on South Korean entities. CERT-In warned of 'Crafty Falcon' usage in financial and cryptocurrency sectors. The original repo was taken down, but forks continue. Censys telemetry shows widespread public exposure and shared infrastructure with other AI tools.
Unconfirmed: Repo takedown and author denial of involvement; attributions have moderate confidence.
- 1465 ARTEX consoles exposed publicly worldwide
- 650 hosts in two identical hosting blocks
- 155 hosts (10.6%) also run threat artefacts
- CyberStrikeAI appears on 70 ARTEX hosts
- 32 hosts contain public attack tool directories
| Product | Affected |
|---|---|
| ARTEX | — |
- Threat actors
- Storm-0940Crafty Falcon
- Organizations
- Censys Advanced Research Collective
- Countries
- ChinaSouth Korea
- AI models
- Anthropic Claude
From the original article
3 min read at infosecurity-magazine.com
A new Censys report showed that the use of ARTEX, an AI pentesting tool popular with threat actor, could be spreading far beyond initially reported campaigns
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.