Hunt.io Traces ARTEX Infrastructure Through Exposed Directories and Tooling
Summary
Hunt.io analyzed exposed directories linked to ARTEX, finding AI model-routing components, remote-access and proxy tools, and staged JNDI/LDAP exploitation infrastructure. The artifacts’ relationship to the reported South Korean breaches remains unconfirmed.
Key points
- An exposed directory at 23.248.226.250 contained configurations and scripts linking the Hong Kong jump host to the reported ARTEX console.
- Claude Code configurations, routing shims, and 19 custom agent skills indicated workflows for reconnaissance, web testing, payment analysis, and mobile operations.
- Proxy-enumeration scripts identified 79 unique exit IPs in an initial sample of 100 identities.
- A staged JNDI/LDAP setup included a Java class designed to execute commands and signal results through a DNS callback; logs dated the setup to October 5, 2026.
- Hunt.io searches returned 19 IPs sharing an ARTEX certificate issuer, 1,303 IPs tagged ARTEX, and about 1,300 matching a console title; the article says these leads need further validation.
- Artifacts associated with cryptocurrency access, Linux exploitation, and mobile-device operations were recovered, but their direct relationship to the reported South Korean breaches was not confirmed.
Article Details
- Attack Vectors
- Exposed directories on 38.244.50[.]120 and 23.248.226[.]250 contained configuration files, credentials references, scripts, and operational tooling.
- Recovered shell scripts used sshpass for SSH operations to a remote root account and maintained reverse SSH tunnels.
- A staged JNDI/LDAP setup constructed Java naming references pointing to an Exploit.class that invoked system commands and attempted a DNS callback; its direct role in the reported breaches is unconfirmed.
- Proxy-enumeration scripts tested multiple identities against a rotating proxy service and recorded observed exit IPs.
- Recovered scripts and toolkits supported asset discovery, SMB reconnaissance, Linux privilege escalation, and mobile-device operations.
- A recovered FOFA client queried a third-party API for asset-search results.
- Defensive Notes
- Remove unnecessary public access to administrative services; restrict required access to approved VPNs, allowlists, or dedicated management networks.
- Reset exposed SSH passwords and rotate API keys, proxy credentials, service tokens, and other potentially exposed secrets.
- Patch internet-facing services and validate authentication, authorization, and access controls for sensitive administrative functions.
- Monitor for unexpected LDAP/JNDI activity, anomalous DNS callbacks, remote script downloads, unusual process execution, and unexplained outbound connections.
- Enforce least-privilege file permissions and store credentials in a managed secrets store.
- Restrict access to model gateways and monitor for unexpected destinations, unauthorized model endpoints, and suspicious automation.
- For managed Android and iOS devices, enforce compliance policies, trusted firmware requirements, application controls, and monitoring for unauthorized rooting, bootloader modification, or jailbreaking.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | xcai[.]pro | LLM reseller domain associated in reporting and recovered configuration with the campaign's model-routing setup. |
| HOSTNAME | direct[.]xcai[.]pro | Model-routing endpoint referenced in the recovered configuration as part of the campaign's request path. |
| HOSTNAME | u6ud2s[.]dnslog[.]cn | DNS callback hostname embedded in the staged JNDI/LDAP command-execution artifact. |
| IPV4 | 130[.]94[.]31[.]86 | ARTEX-associated host with an exposed directory containing files classified as malicious by AttackCapture. |
| IPV4 | 154[.]201[.]79[.]246 | Proxy-service endpoint enumerated by recovered scripts and also reported as campaign-related infrastructure. |
| IPV4 | 156[.]251[.]11[.]39 | ARTEX-associated host exposing an Impacket-based SMB reconnaissance and lateral-movement toolkit. |
| IPV4 | 23[.]248[.]226[.]250 | Hong Kong jump host associated with the reported campaign; exposed directories contained supporting scripts and tooling. |
| IPV4 | 38[.]244[.]50[.]120 | ARTEX console host and SSH tunnel destination referenced in recovered campaign configuration. |
| SHA256 | c7a884afcd7f91408921890d9617bef6bfac3dae992bc25bb9c48c0395a60842 | TLS certificate fingerprint associated with the ARTEX console at 38.244.50[.]120. |
MITRE ATT&CK
T1005 · Data from Local SystemA recovered script supported collecting local configuration and key files.T1021.002 · SMB/Windows Admin SharesThe exposed Impacket toolkit enumerated SMB shares, and associated tooling mapped access to internal SMB services.T1021.004 · SSHRecovered scripts used sshpass for SSH operations against a remote root account and managed reverse SSH tunnels.T1027 · Obfuscated Files or InformationA recovered Godzilla webshell generator produced PHP stagers obfuscated with AES, Base64, and XOR.T1046 · Network Service DiscoveryAn exposed post-exploitation toolkit included multithreaded port scanners.T1053 · Scheduled Task/JobA recovered toolkit targeting a RuoYi or Spring administrative console abused its scheduled-job API to execute shell commands.T1059 · Command and Scripting InterpreterThe staged Exploit.class invoked system commands including id, hostname, and uname -a; recovered shell scripts also contained command-execution functionality.T1068 · Exploitation for Privilege EscalationRecovered artifacts included Linux privilege-escalation exploit builds, including builds associated with CVE-2022-2588 and CVE-2025-5054.T1090 · ProxyProxy-enumeration scripts tested identities against the service at 154.201.79[.]246 and tracked its observed exit IPs.T1105 · Ingress Tool TransferCode-search results included commands designed to download and execute remote scripts.T1110 · Brute ForceAn exposed toolkit included a WinRM credential-spraying script.T1190 · Exploit Public-Facing ApplicationA staged JNDI/LDAP rig constructed Java naming references that pointed to Exploit.class for remote command execution; the article does not establish that this rig caused the South Korean breaches.T1550.002 · Pass the HashAn Impacket-based toolkit used hardcoded NTLM hashes for pass-the-hash authentication during SMB reconnaissance.T1552.001 · Credentials In FilesThe exposed .secrets file and its backup contained references to API, relay, and proxy credentials.T1572 · Protocol TunnelingChisel reverse tunnels in an exposed toolkit mapped public ports to internal SMB, RDP, and WinRM services.
CVE
CVE-2022-2588Siemens · SIMATIC S7-1500 TM MFP - GNU/Linux subsystem; The Linux Kernel Organization · linuxexp2588_44 Exploit or proof-of-concept builds associated with CVE-2022-2588.CVE-2025-5054Vendor / Product unavailablemusl builds Multiple binaries associated with CVE-2025-5054, including statically linked or alternative-library builds.
Vendors
Anthropicrecorded startups since August 4, 2026. However, the installation is not communicating directly with Anthropic's API.DeepSeekThe recovered configuration and routing scripts reference DeepSeek, GLM, and Grok-related components, providing evidence of a multi-model setup consistent with the reported use of alternative AI services.WebshareThe additional credential fields identify other configured services, including a Zhipu AI API key, an OpenAI-compatible relay key, and Webshare credentials.Zhipu AIthreat group. The assessment identified DeepSeek v4.1 Flash as the primary model, with GLM 5.3 from Zhipu AI and Grok 4.6 serving as backup models.
Products
Claude CodeThe analysis found Claude Code configurations, custom model-routing shims, and 19 agent skills that supported reconnaissance, web testing, payment logic analysis, and mobile operations.DeepSeek v4.1 Flashmotivated by financial gain rather than an established threat group. The assessment identified DeepSeek v4.1 Flash as the primary model, with GLM 5.3 from Zhipu AI and Grok 4.6 serving as backup models.GLM-5.3an established threat group. The assessment identified DeepSeek v4.1 Flash as the primary model, with GLM 5.3 from Zhipu AI and Grok 4.6 serving as backup models.Grok 4.6The assessment identified DeepSeek v4.1 Flash as the primary model, with GLM 5.3 from Zhipu AI and Grok 4.6 serving as backup models.
Tools
ARTEXIn early October 2026, CrowdStrike reported that an unknown, financially motivated threat actor had used ARTEX, an AI-driven autonomous penetration testing framework, in intrusions targeting South Korean financialChiselscanners, Impacket-based SMB enumeration with hardcoded NTLM hashes for pass-the-hash authentication, and Chisel reverse tunnels mapping public ports to internal SMB, RDP, and WinRM services.Claude Code RouterCCR, or Claude Code Router, is an open-source project that enables Claude Code to communicate with alternative model backends. The xcai[.]pro domain is also significant: CrowdStrike has reportedly identified it as anFOFAFOFA-related tooling and a proxy service at 154.201.79[.]246:443 provided additional infrastructure pivots, with 79 unique exit IPs observed in an initial sample of 100 identities.ImpacketActive Malware: ARTEX and the Potential Malicious Open Directory warningThe open directory contains an Impacket-based toolkit focused on SMB and printer RPC reconnaissance, credential-based authentication, andsing-boxlocal-boot.sh restores a reverse SSH tunnel after startup, forwarding the local service on port 8100 to the jump host, and launches a local sing-box relay configured to listen on port 11050.sshpassand sync-memory.sh) recovered from the same host. All three reference 38.244.50[.]120 and use sshpass to supply a password for SSH-based operations targeting the remote root account.
Countries
Chinaattributed the activity to ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under the GNU Affero General Public License version 3.0 (AGPL-3.0).Hong KongOur investigation revealed a new open directory at 23.248.226[.]250 which acts as a Hong Kong-based jump server.South KoreaOpen Directory. The system is associated with LIGHT NODE LIMITED (AS154177), located in Seoul, South Korea.United Statesoperated by Cogent Communications, LLC. Hunt.io identifies its location as Los Angeles, California, United States. The record shows seven warnings, 73 associations, 17 pivots, and 13 code search results.