Hundreds of password-free Artex copies found online

What researchers found

Artex is an open-source program that automatically searches computer systems for vulnerabilities. It was released in July; anyone can download the tool and run it on their own servers. Artex has become popular among people who do not have access to advanced cybersecurity models from Anthropic or OpenAI.

Microsoft previously described Artex as a system of AI agents capable of carrying out cyberattacks, from reconnaissance to data theft, with minimal human involvement.

Censys scans the internet for exposed and vulnerable systems. In a blog post, the company said it had found more than 800 individual Artex instances accessible online without a password.

Silas Cutler, Censys’s lead security researcher and the author of the post, noted that not all copies are used for malicious purposes: many are used by specialists for authorized testing. But it is unclear why hundreds of systems are exposed to the internet; the program itself does not require that access.

Exposed copies could reveal attackers’ tools, including implants: stealthy malware that helps break into a victim’s network and maintain access. The case also shows how misconfiguration can expose even powerful hacking tools to outsiders.

Artex linked to attacks

Cybersecurity companies have linked Artex to several major attacks, including an attack on South Korea’s financial sector in September. CrowdStrike attributed those attacks to a Chinese-speaking hacker, citing the use of Artex and a folder of the system’s files that the hacker had left exposed.

According to Censys, that Artex instance remained accessible online for months. The company believes it may have contained information about attacks not only on South Korean banks, but also on payment and gaming companies.

In early October, Artex was also used in an attack on ConnectWise, a major IT support company. China-linked hackers were able to spy on thousands of organizations whose data and files were hosted in Microsoft’s cloud. Microsoft said the attackers used Artex to break into customers’ cloud environments and steal data so quickly that defenders had little time to detect and respond to the attack.

Many Artex-linked attacks exploited simple weaknesses: weak or known passwords and a lack of multifactor authentication. Configuration errors can expose both attackers’ tools and their targets’ systems to outsiders.

What changed in access to the tool

Artex announced that it is moving to closed-source development. This will limit future releases to paying customers, but dozens of copies of the source code are still available on code-sharing sites and may be used in active attacks.

Dataist's take: Closing the source code does not resolve the problem already uncovered: copies of the program remain accessible online. And the attacks show that simple mistakes — weak passwords and exposed access — can be enough to cause serious damage.