Censys, a security firm that scans the internet, described its findings in a blog post that TechCrunch and GBHackers covered on 6 November. TechCrunch reported that Censys identified more than 800 distinct ARTEX deployments accessible from the web without a password. GBHackers added that the open management console was visible on 1,465 servers on 4 November. About 650 of them sat on two networks with identical default settings, leaving roughly 815 distinct-looking deployments.

ARTEX is an open-source penetration testing tool: a program that looks for weaknesses in computer systems automatically. It was released in July. The user sets a goal and a permitted scope. A planning agent turns the goal into attack intents, and worker agents run the tools.

Exposed servers also reveal attackers’ tools

Silas Cutler, principal security researcher at Censys, stressed that not every deployment is used maliciously: many are run by authorised testers. The software does not need to be reachable from the internet, so it is unclear why the deployments are exposed. The visible deployments are therefore likely only some of the total, GBHackers said.

TechCrunch reported that outsiders could use the exposed deployments to carry out attacks. Open directories on 32 servers also held credentials and implants, hidden malware that lets an attacker keep access to a victim’s network, GBHackers wrote.

CrowdStrike linked one ARTEX server to attacks on South Korean financial companies. Censys said the server’s directories had been open since 18 August, seven weeks before CrowdStrike published its findings.

From leaked GitHub credentials to Key Vault in five minutes

Microsoft said in a report on 5 November that ARTEX agents had been searching GitHub for credentials since August, Cybersecurity News and GBHackers reported. The searches combined target companies’ names with terms related to secrets, cloud services and AI services. The haul included application credentials and API keys for AI inference services.

In one case, the agent moved in five minutes from a GitHub search to exporting data from Azure Key Vault, Microsoft’s service for storing secrets. The figure describes one documented case, not the duration of every attack.

From 28 October, the attackers signed in to Microsoft Entra ID environments with application credentials. Some of the credentials belonged to vendor applications used by many customer organisations, so the risk extended to those customers too. When a request failed because of a wrong API version, the agent switched versions and succeeded about 28 seconds later.

Microsoft has previously said that the China-linked group Storm-0940 used ARTEX in a breach of ConnectWise’s cloud backup service, GBHackers reported. The site added that this attribution should not automatically be applied to the credential abuse.

Microsoft advises treating credentials that have become public as compromised, even if the code has been deleted. They must be revoked or rotated, as must the secrets in any Key Vaults the application could read. Access tokens already issued remain valid until they expire, even if the application’s identity is disabled. In the longer term, Microsoft recommends managed identities, together with GitHub secret scanning and push protection, which blocks secrets from being pushed to a repository.

TechCrunch reported that ARTEX has announced it will go closed-source, with new releases available only to paying customers. Dozens of copies of the code nonetheless remain on code-sharing platforms.