Censys finds more than 800 Artex hacking-tool deployments exposed online
🎧 Listen to this story
Security firm Censys identified more than 800 distinct Artex deployments accessible from the internet without a password. The Chinese-made open-source software automates penetration testing and, according to Microsoft, can conduct attacks from reconnaissance through data exfiltration with little human interaction. Censys researcher Silas Cutler said not every instance was operated maliciously, but the software does not need to be exposed to the internet. Publicly accessible systems can also reveal implants used to maintain access to victims’ networks.
Security companies have linked Artex to attacks against South Korea’s financial sector in September and, according to Microsoft, to an October intrusion at ConnectWise that allowed China-linked hackers to spy on organizations with data in Microsoft’s cloud. CrowdStrike attributed part of the attacks to a Chinese-speaking hacker. Artex later announced that it would become closed-source, although dozens of copies of its code remain available on code-sharing sites.
Why it matters · editorial interpretation
Censys’s discovery of more than 800 Artex installations accessible without passwords turns a testing tool into an operational risk when exposed to the internet, although Censys noted that not all were malicious. The case also suggests that code copies remain available despite Artex’s announced shift to a closed-source model.
Sources
Security