Censys Maps ARTEX Infrastructure and Related AI Attack Frameworks
Summary
Censys ARC reports identifying 1,465 ARTEX-associated hosts and web properties. Scan history and host pivots revealed exposed agent files, rapidly changing open directories, co-located threats and self-hosted LLM gateways.
Key points
- CrowdStrike linked ARTEX to intrusions at South Korean financial institutions; Microsoft tied it to Storm-0940’s ConnectWise supply-chain compromise.
- Censys scan history showed an ARTEX-associated directory serving files from August 18, 2026, including a .claude folder, prompts, session histories and configuration files.
- Censys says its ARTEX label covered 1,465 hosts and web properties; 155 also had another detected threat, and 43 ran self-hosted LLM gateways.
- ARC counted 32 open directories on ARTEX hosts. From November 3 to 5, ten closed and fifteen new ones appeared.
- Censys found 70 hosts shared by ARTEX and CyberStrikeAI, and tracked related frameworks including ScopeWeaver, PentAGI, HexStrike AI, RedAmon and Cairn.
- The article recommends using scan history, exposed agent artifacts and console fingerprints for investigation and detection; it notes that some exposed consoles may belong to authorized testers.
Article Details
- Attack Vectors
- ARTEX is described as an autonomous, multi-agent AI penetration-testing and offensive framework that was used in reported intrusions.
- An ARTEX operator exposed a working directory through an open directory on a public host, revealing prompts, session histories, and configuration files.
- The article says operators may expose working directories using short-lived Python HTTP servers on high ports, making agent instructions and configuration files publicly accessible.
- Censys observed attack-framework consoles and other detected threats co-located on some hosts; the article cautions that some consoles may belong to authorized testers.
- Defensive Notes
- Continuously monitor exposed Internet-facing consoles and services, and close those that should not be public.
- Investigate IPs and domains even when reputation services show no hits; a clean reputation result does not establish that infrastructure is benign.
- Use scan history to investigate what a host served during an intrusion, including directories that have since closed.
- Monitor for agent artifacts such as CLAUDE.md, AGENTS.md, GEMINI.md, .claude directories, and .mcp.json files exposed through open directories.
- Use console fingerprints and deployment signals, including port 8787, unfamiliar LLM gateways, mitmproxy banners, and short-lived Python HTTP servers on high ports, to identify suspicious hosts and earlier activity.
- Review outbound connections for unfamiliar LLM gateways and API resellers, and check organizational IP ranges for exposed attack-framework consoles.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 38[.]244[.]50[.]120 | CrowdStrike identified this host as the location of an ARTEX operator's open directory, which exposed prompts, session histories, and configuration files. |
| IPV4 | 43[.]255[.]159[.]10 | Censys scored this host as malicious, despite vendors not flagging its IP or associated DNS resolution. |
Threat Actors
Vendors
Censys CrowdStrike tied it to intrusions at South Korean financial institutions on October 7, and Microsoft tied it to Storm-0940’s ConnectWise supply-chain compromise two weeks later (read the Censys ARC writeup).CrowdStrike CrowdStrike tied it to intrusions at South Korean financial institutions on October 7, and Microsoft tied it to Storm-0940’s ConnectWise supply-chain compromise two weeks later (read the Censys ARC writeup).Microsoft CrowdStrike tied it to intrusions at South Korean financial institutions on October 7, and Microsoft tied it to Storm-0940’s ConnectWise supply-chain compromise two weeks later (read the Censys ARC writeup).ThreatBookThe origin story is murkier than “hobbyist tool gets abused.” On October 16, the Chinese security vendor ThreatBook said ARTEX began as a personal project by its RedAgents product lead, and acknowledged that the
Products
Censys EnterpriseCensys scan history shows that directory serving files starting August 18, 2026, seven weeks before the report went public (you could’ve found it yourself with Censys Enterprise).Censys Internet MapCensys ARC writes fingerprints of AI attack tools against the Censys Internet Map, which Censys builds by scanning and actively resolving DNS.
Tools
Adaptix C2in early November, that 155 of the 1,465 ARTEX hosts also ran another detected threat (Cobalt Strike, Adaptix C2, Vshell among them), and that 43 ran self-hosted LLM gateways such as CLIProxyAPI and New API.ARTEXHow ARTEX spread: A new name every weekCairnAnother tool, Cairn, followed a similar arc.Cobalt Strikehow ARC found, in early November, that 155 of the 1,465 ARTEX hosts also ran another detected threat (Cobalt Strike, Adaptix C2, Vshell among them), and that 43 ran self-hosted LLM gateways such as CLIProxyAPI and NewCyberStrikeAITwo weeks before that, ThreatBook had acquired CyberStrikeAI outright, citing 6,600 GitHub stars and deployments in more than 2,300 networks.HexStrike AIHexStrike AI AI attack framework seen co-located with ARTEX.mitmproxyScan history adds an earlier tell: mitmproxy banners and short-lived Python HTTP servers on high ports often appear on a host before the ARTEX console does.PentAGIPentAGI Autonomous pentest agent. Seen with ARTEX, including beside a Cobalt Strike teamserver at 1.14.104[.]208.RedAmonRedAmon AI attack framework seen co-located with ARTEX.ScopeWeaverForks and rebrands such as ScopeWeaver were circulating before the original ARTEX repository came down.VShellNovember, that 155 of the 1,465 ARTEX hosts also ran another detected threat (Cobalt Strike, Adaptix C2, Vshell among them), and that 43 ran self-hosted LLM gateways such as CLIProxyAPI and New API.
Countries
ChinaSo the two agentic attack tools that most often share a server also share a link to one company, which bills itself as China’s first threat intelligence vendor.South Korea CrowdStrike tied it to intrusions at South Korean financial institutions on October 7, and Microsoft tied it to Storm-0940’s ConnectWise supply-chain compromise two weeks later (read the Censys ARC writeup).