1,465 ARTEX Consoles Are Sitting Open Online, and Two Hosting Blocks Explain 650 of Them

Microsoft says a Cambodia-based intrusion group it tracks as Storm-3358 used an open-source agentic AI penetration testing framework called ARTEX to target financial organizations in Southeast Asia and a smaller number of large financial firms elsewhere. The finding, published on 6 November, is Microsoft’s second report on ARTEX in just over two weeks.

Censys put a number on the tool’s sloppy footprint the day before. As of 3 November, it counted 1,465 internet hosts running an exposed ARTEX console, with the largest concentrations in the United States, Hong Kong, China, Japan, Singapore and South Korea.

But 1,465 is not a count of attackers or victims. About 650 of those hosts sit in two identically configured hosting blocks, which leaves roughly 815 distinct-looking deployments. And an exposed console belongs to whoever is running the tool, not to the bank on the other end of it.

Quick answer: ARTEX is a free, LLM-driven pentesting framework released in July 2026 that plans and runs attacks with autonomous agents. Microsoft has now tied it to a financially motivated group hitting banks, while Censys found 1,465 of its web consoles exposed online. The exposure is a gift to defenders, but it maps attack infrastructure, not confirmed victims, and the real breach count remains unknown.

What ARTEX actually is

ARTEX was published on GitHub as Autumn-27/ARTEX on 26 July 2026 under the AGPL-3.0 licence. Its author also built ScopeSentry, a Chinese asset-discovery scanner with more than 2,000 GitHub stars.

The stack is Go for the engine, Next.js for the console and PostgreSQL for storage. A Planner agent turns a goal such as “gain admin panel access” into attack intents. Worker agents claim those intents, run tools including Nmap and curl, and write results back into an asset graph and an exploration graph.

It works with Anthropic, OpenAI or any OpenAI-compatible endpoint. That matters because the cost of running a competent attack agent now depends mostly on API pricing, not on hiring.

The number that matters: 1,465 consoles

Censys detects ARTEX consoles by their page title and Next.js static assets. As of 3 November, that fingerprint matched 1,465 hosts.

New #ARTEX research from @silascutler: 1,465 hosts exposing its console, open directories leaking operator tools, and AI frameworks running alongside established C2.

Includes Censys queries to investigate the infrastructure yourself:https://t.co/QceGfvV7xF#CENSYSARC…

— Andrew Northern 𓅓 (@ex_raritas) November 6, 2026

The distribution is not a simple China story. The United States accounts for 726 hosts, Hong Kong for 387, China for 177, Japan for 51, Singapore for 38 and South Korea for 21.

Two hosting providers account for about 44% of the total. PEG Tech carried 493 hosts across 13 /24 networks, and Yancy Limited carried 157 on a CyberPanel template. Censys treats those as provisioning templates rather than hundreds of separate operators.

Of the 1,465 hosts, 155 also carry at least one other threat detection. CyberStrikeAI shares a host with ARTEX on 70 of them. Others sit next to Cobalt Strike, Adaptix C2, Vshell and Gophish. Forty-three hosts also run self-hosted LLM gateway or reseller software, mainly CLIProxyAPI and New API.

Censys also found 32 open directories leaking the operators’ own tooling. One exposed an entire home directory, including .ssh, .bash_history and the ARTEX install. Another exposed a MITM root CA private key and about 18 HTA droppers.

Two campaigns, one toolkit

The first documented malicious use came from CrowdStrike on 7 October. An unattributed, likely Chinese-speaking and financially motivated actor breached a broker-facing loan inquiry service at one South Korean bank and an employee mobile work system at another, then exfiltrated data. CrowdStrike assessed the actor with moderate confidence and said the number of affected organizations remained unconfirmed.

The actor’s ARTEX instance used DeepSeek v4.1-flash as its primary model, supplemented with GLM-5.3 and Grok 4.6 in Claude Code sessions. Exposed Claude Code session histories also showed the operator asking an assistant where stolen Korean data is sold and requesting a security researcher CV built from the campaign.

Microsoft’s 6 November report describes a separate cluster. Storm-3358 is a Cambodia-based, financially motivated group that began using ARTEX in October against financial organizations in Southeast Asia plus a smaller number of large firms globally. Microsoft observed ARTEX agents scanning public-facing systems, exploiting anonymous file upload and server-side request forgery flaws, and downloading the WISP, vshell and AdaptixC2 remote access trojans with netcat and curl.

Microsoft had already attributed the ConnectWise Cloud Backup supply-chain compromise to a China state-aligned group it calls Storm-0940 in a 21 October report. ARTEX automated scanning, password spraying and OAuth application abuse in that campaign, according to Microsoft’s summary that Censys cites.

The common thread is not a new exploit. It is speed. The same lesson came from Cursor’s 11-hour backdoored update. ARTEX agents retry variations at machine speed, chain tools that already exist, and keep going after a failed attempt. Microsoft’s own guidance concedes that blocking default user agents will not stop an agent that can switch them.

Confirmed vs not confirmed

What it means for Indian developers

There is no public evidence that Storm-3358 or the South Korean actor touched an Indian bank. The relevance is structural. Indian fintech and banking systems expose large numbers of public APIs, broker portals and employee mobile tools, which is the exact surface ARTEX is built to map and test.

Agentic scanners generate a wide variety of requests in a short window and retry variations quickly. They lean on Nmap, curl, wget, Playwright and headless Chromium, often with default user agent strings. Blocking those signatures alone will not stop an agent, but spotting them early gives a defender a head start.

Microsoft’s more interesting finding is that deception works better than blocking. Honeypots, decoys and tarpits pulled autonomous agents away from real assets in Microsoft’s testing. Fake wins, where a decoy convinces the agent that its objective is complete, caused some runs to stop on a false success.

Put MFA and conditional access in front of every cloud identity the agent could reach. Log unfamiliar LLM gateways and resellers in egress traffic, since 43 exposed hosts ran exactly that software, much as Cloudflare once leaked prompts through a cache ceiling. And treat API enumeration, password spraying and database dumping as one combined signal rather than three separate alerts.

The economics are the uncomfortable part. ARTEX is gone from GitHub, but archived copies and rebrands such as ScopeWeaver still circulate, and the underlying models are priced per token. A mid-sized Indian team can now rent the same attack loop that hit a Korean bank. The defence budget has to scale with that, not with headcount. Teams that already run AI agents against their own code have a head start, provided they also watch what those agents can reach.

FAQ

What is ARTEX?

ARTEX is an open-source, LLM-driven autonomous penetration testing framework released in July 2026. It uses planner and worker agents to scan targets, choose exploits and repeat attempts until a goal is reached.

Did AI write the attacks or just run the tools?

The models planned and sequenced the work, but the exploits and post-exploitation tools were conventional. Microsoft observed ARTEX agents calling netcat, curl, Nmap and existing remote access trojans.

Are the 1,465 hosts victims?

No. Those are machines running ARTEX consoles, which means they are attack infrastructure or test labs. Censys says some are likely authorized testers. The victims are the organizations the agents were pointed at, and their number is not public.

Should Indian banks worry?

They should check, not panic. No source has reported an Indian victim, but Indian financial services expose exactly the kind of public APIs and broker portals ARTEX targets. Patch SSRF and unrestricted upload flaws first.

What should defenders do first?

Hunt for agent-like traffic patterns, review egress for unknown LLM proxies, enforce MFA on cloud identities, and deploy decoys that waste an agent’s time.

Sources

• Microsoft Threat Intelligence, “ARTEX abuse expands as cybercriminals target financial sector”, 6 November 2026
• Censys ARC, “ARTEX: Agentic Asbestos”, 5 November 2026
• CrowdStrike, “Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance”, 7 October 2026
• Microsoft Threat Intelligence, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise”, 21 October 2026
• Andrew Northern, Censys ARTEX research announcement, 6 November 2026