AhnLab Tests ARTEX, Finding Autonomous Command Execution and Lateral Movement

Oct 14, 2026 · Original article ↗

Summary

AhnLab’s tests found that ARTEX could exploit a file-upload flaw and an exposed ActiveMQ service to execute commands and reach internal hosts. Infrastructure analysis also found some ARTEX-related servers containing attack-related tools and files.

Key points

AhnLab identified 600 public IP addresses hosting ARTEX instances and later confirmed about 900 ARTEX-associated IP addresses were publicly accessible; it cautioned that these are not all necessarily attacker infrastructure.
Two operational directories contained ARTEX paths alongside artifacts including a web shell command channel, RDP relay materials, internal network scans, SSH automation, and Linux and Windows implants.
In a test environment, ARTEX used a vulnerable file-upload feature to upload a web shell and execute a program on a Windows server without further user intervention.
In a separate test, ARTEX exploited ActiveMQ 5.15.15 via CVE-2023-46604, then achieved remote command execution on four internal hosts.
AhnLab found that User-Agent values vary by tool and activity, may be absent or altered, and are not reliable proof of ARTEX use on their own.
The report recommends reducing exposed services, patching vulnerabilities and misconfigurations, restricting accounts and internal access, and correlating endpoint, network, web, and authentication telemetry using EDR and XDR.

Article Details

Attack Vectors: In a test environment, ARTEX used a web page's file-upload feature to upload a web shell and execute a program on the web server.
In a separate test, ARTEX targeted Apache ActiveMQ 5.15.15 over OpenWire on TCP port 61616, using CVE-2023-46604 for initial access; it then achieved remote command execution on four internal hosts.
Operational files found on some exposed ARTEX hosts included materials for internal network scanning, SSH access, Pass-the-Hash-style RDP connection attempts, and follow-up payload deployment. The article does not confirm that all these activities succeeded.
Defensive Notes: Reduce unnecessary exposure of public-facing services and management functions, and promptly remediate vulnerabilities and misconfigurations.
Restrict account privileges and access to internal networks to the minimum necessary scope.
Use EDR to monitor file and process execution on servers and PCs, and correlate endpoint findings with web, network, and authentication logs using XDR.
Do not rely on a single User-Agent or tool signature as definitive evidence; correlate sequences of behavior across web, firewall, network-connection, service-access, authentication, and endpoint logs.