Researchers Trace ARTEX-Based Tools and Exploit Artifacts in Bob Research Labs Environment
Summary
AhnLab researchers found ARTEX-derived tools distributed under altered names and analyzed a Bob Research Labs environment containing CVE-2026-75650 exploit artifacts and an IRC implant. They also found exposed source code, credentials, logs, and attack tools.
Key points
- After the original ARTEX GitHub repository disappeared, researchers found independent distributions retaining ARTEX code while changing names, interfaces, settings, and language.
- Variants included ScopeWeaver, Tangora PTaaS, Horda, Meze, AegisLoop, and Bob Research Labs; some were adapted for penetration testing, code auditing, or general-purpose agent tasks.
- In the Bob Research Labs environment, researchers found different frontends on TCP ports 3001 and 443, along with paths referencing artex-linux-amd64 and a renamed reaper-full project.
- The REAPER build retained ARTEX's multi-agent orchestration, with task states restored from PostgreSQL and tasks assigned to a Planner and up to three Workers.
- Researchers found a working copy of the public StyleSmuggler PoC for CVE-2026-75650 and artifacts suggesting steps resembling the PoC's Magento checkout exploit flow had been performed.
- An IRC implant, irc.php, included persistence features and command handling for a password-protected IRC channel; the environment also contained a cache.php payload and related files.
- The researchers reported exposed source code, credentials, development artifacts, runtime logs, and attack tools, indicating poor operational security.
Article Details
- Attack Vectors
- The article reports a working copy of StyleSmuggler, a public PoC for CVE-2026-75650, in the Bob Research Labs environment. The PoC targets an unauthenticated Magento/Adobe Commerce remote code execution vulnerability through Guest Cart creation, billing-information manipulation, and the vulnerable checkout flow.
- The article reports an IRC implant that receives remote commands and includes PHP execution functionality, as well as an @reboot cron job for persistence.
- Defensive Notes
- The article reports that source code, credentials, development artifacts, runtime logs, and attack tools were exposed on the internet, indicating poor OPSEC.
MITRE ATT&CK
T1053.003 · CronThe irc.Php implant includes an @reboot cron job for persistence.T1059 · Command and Scripting InterpreterThe irc.Php implant can receive !Cmd@ and !Cmd@all commands and supports multiple PHP execution functions.T1071 · Application Layer ProtocolThe irc.Php implant uses an IRC channel, #mg_master, as a remote control channel.T1190 · Exploit Public-Facing ApplicationThe reported StyleSmuggler PoC targets CVE-2026-75650, an unauthenticated remote code execution vulnerability in Magento/Adobe Commerce.
CVE
Products
Adobe CommerceA working copy of StyleSmuggler—the publicly available PoC for CVE-2026-75650 (a Magento/Adobe Commerce remote code execution vulnerability exploitable without authentication)—was exposed in the Bob Research LabsARTEXAnalysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy CatMagentoA working copy of StyleSmuggler—the publicly available PoC for CVE-2026-75650 (a Magento/Adobe Commerce remote code execution vulnerability exploitable without authentication)—was exposed in the Bob Research LabsREAPERCase Study: Bob Research Labs / THE GRIM REAPER