FBI says Artex AI tool automates intrusions against critical sectors
Original title: FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’
Some intrusions reached privileged access in under three hours; Censys saw over 1,600 exposed consoles.
The FBI said Friday that open-source Artex is being used by cybercriminals and nation-states to automate intrusions from reconnaissance through data exfiltration. Released on GitHub in August by the account Autumn-27 and later removed, it still spreads through forks, archives and a commercial version. It can drive agents with models including Claude, GPT and DeepSeek. Reported targets include government and critical industries, South Korean and Japanese financial firms, and a supply-chain attack on ConnectWise.
Unconfirmed: Campaign details are claims from the FBI, Microsoft and Amazon, not independently verified here.
- Developer Li Puhua said on October 8 the tool was abused and denied responsibility.
- DeepSeek Flash models dominated analyzed attacker instances, the FBI said.
- Amazon described Chinese-nexus groups stealing keys to pay for further inference.
- Amazon also described real-time deepfakes used to bypass exchange KYC checks.
- Agents map trust relationships and target weaker partner and legacy systems.
Impact: Automated intrusion, data theft and credential access
- Malware
- Artex
- Victims
- ConnectWise
- Countries
- ChinaSouth KoreaJapan
From the original article
3 min read at therecord.mediaOpen source hacking tool Artex "significantly reduces the time required to chain attack techniques, with some intrusions progressing from initial targeting to privileged access in under three hours," the FBI said.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.