ARTEX's Developer Pulled the AI Hacking Tool in October. Censys Then Found 1,465 Exposed Consoles

When an offensive tool is caught in a high-profile attack, the usual hope is that taking it down slows the attackers who relied on it. ARTEX is testing that hope and failing it. The AI penetration testing framework was pulled from GitHub in October after it was linked to bank breaches in South Korea. In the four weeks since, researchers have found its consoles on more than a thousand internet-facing servers, a software company has traced a breach to it, and Microsoft has named a fresh criminal crew running it against the financial sector.

A Tool That Outlived Its Takedown

ARTEX was published on GitHub on July 26 under an open source AGPL-3.0 license, according to an analysis by Censys. It is written in Go and pairs a planner agent with worker agents that map a target, track what they have tried and decide the next step. CrowdStrike published its report on the South Korean attacks on October 7, and the developer posted a statement on October 8 denying involvement and saying the project would go closed-source. Genians Security Center reported that the original repository and Docker image were removed on October 11.

None of that pulled the tool back from the people already using it. Censys counted 1,465 hosts exposing an ARTEX console in early November. About 650 of them sit in two blocks of identically configured hosting, which leaves roughly 815 distinct-looking deployments, and Censys says the true total is probably higher because the console does not need to face the internet at all. The United States hosted the most, with 726, followed by Hong Kong with 387 and China with 177. On 155 of the hosts, or 10.6%, Censys also detected at least one other threat, including command-and-control tools such as Cobalt Strike and Vshell.

Not every exposed copy is malicious. Censys researcher Silas Cutler told TechCrunch that many instances are used by authorized testers. But TechCrunch also reported that dozens of copies of the code remain on code-sharing sites, so going closed-source mainly limits future releases to paying customers. Anyone who already had the open source build can keep running it.

From Korean Banks to a SaaS Sales App

The campaign that made ARTEX notorious ran from late September to early October. Hunt.io's infrastructure analysis puts the toll at seven South Korean financial institutions, with about 66,000 to 67,000 individuals and roughly 2,200 corporations affected, and exposed data covering personal, employment, income and loan details. CrowdStrike assessed with moderate confidence that a single Chinese-speaking, financially motivated operator was responsible. The operator's own files show how little the attack needed from a person: a Claude Code installation started 510 times since August 4, routed through a model reseller to DeepSeek, and 19 custom agent skills invoked 147 times for reconnaissance, web testing, firewall evasion and payment-logic testing.

The targets are widening. Identity platform WorkOS said it identified unauthorized access on October 30 to an internal application its sales team uses, exposing business contact records and summaries of customer communications. Founder Michael Grinich told BleepingComputer that investigators found the user agents "artex-enrich/1.0" and "norma/0.4" in the attacker's requests. WorkOS says no production services were affected and the incident is fully contained, but at least 3,000 companies use its services, and it has warned customers to expect phishing built on the stolen details.

Scale is the other change. Censys's summary of earlier Microsoft reporting says a China state-aligned actor, Storm-0940, used ARTEX for scanning, password spraying and OAuth application abuse in the ConnectWise Cloud Backup supply-chain compromise, attempting sign-ins to more than 2,250 tenants at a peak of 2,900 attempts per minute. Some victims saw privileged cloud access in under three hours.

What Microsoft Says Still Works

On November 6, Microsoft Threat Intelligence reported that Storm-3358, a financially motivated cluster it tracks as Cambodia-based, began using ARTEX in October against financial organizations in Southeast Asia and a smaller number of large financial firms worldwide. The agents exploit anonymous file upload and server-side request forgery flaws, pull down open source remote access trojans such as WISP, vshell and AdaptixC2 with curl and netcat, and then move laterally, escalate privileges and exfiltrate data at machine speed. TechCrunch reported that many ARTEX-linked attacks succeeded through weak or known passwords and missing multi-factor authentication.

Microsoft's guidance is notable for what it rules out. Default tool traits such as user agent strings are useful alerts, but blocking them alone will not stop an AI agent that can change them quickly. The signals that hold up are behavioral: a wide variety of requests in a short time, repeated variations on the same technique, and fast progression to next-stage actions. For security teams, that points to a short list:

• Hunt for the known traits anyway. Search web and proxy logs for "artex-enrich/1.0" and "norma/0.4" now. A cheap match tells you whether you were scanned before the operators learn to change the string.
• Alert on tempo, not signatures. Tune detections for bursts of varied requests, rapid retries of one technique and quick escalation from scan to exploit, the patterns Microsoft says agents cannot easily hide.
• Close the identity doors first. Enforce MFA everywhere and block legacy authentication, since password spraying and known credentials opened many of these intrusions, including the 2,250-tenant ConnectWise campaign.
• Fix the web flaws agents look for. Audit internet-facing apps for anonymous file upload and server-side request forgery, the entry points Storm-3358 favors, and treat internal tools like a sales app as exposed if they face the internet.
• Feed the agent decoys. Microsoft found that honeypots, tarpits and "fake wins" cut the attack traffic reaching real assets and produced high-confidence signal, because an agent pursues every lead it is given.
• Watch egress for model resellers. Censys advises that "unfamiliar LLM proxies and resellers in egress logs are worth investigating," a sign that someone inside the network may be running an agent of their own.

ARTEX's developer can stop shipping updates, but cannot recall the copies already running on hundreds of servers. For defenders, the lesson is that an AI attack framework behaves less like a single piece of malware and more like a capability that has now spread. The organizations that fare best will be the ones whose controls assume the attacker is fast, tireless and willing to try everything, because with ARTEX, it is.