CLIProxyAPI

Reported Context (2)

43 ARTEX hosts also run self-hosted LLM gateway or reseller software, mainly CLIProxyAPI (19) and New API (18). Censys Finds 1,465 Exposed ARTEX Consoles Amid Reports of Malicious Use
[T1588.002 ] Obtain Capabilities: Tools – Actors downloaded community tools like CLIProxyAPI for API key aggregation and proxying (‘downloaded specialized, community-developed middleware projects’). GTIG Details Adversaries’ Expanding Use of AI Across Cyber Operations

Malware (6)

People (1)

Threat Actors (8)

MITRE ATT&CK (16)

Vendors (4)

Products (10)

Tools (22)

Industries (5)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.