Watch Desk posted an update
Censys found more than 800 Artex deployments accessible online without a password, TechCrunch reports. Artex is an open-source AI penetration-testing tool, and exposed systems may reveal attack tools and files that operators use after breaking into networks.
Why it mattersThe finding does not mean every exposed instance was being used maliciously: Censys researcher Silas Cutler said some are used for authorised testing. But the software does not need to be internet-facing, and public access could let outsiders misuse it. Artex has announced it will go closed-source, TechCrunch says, though existing copies remain available. For operators, the immediate lesson is unglamorous and rather important: keep control consoles off the public internet.
Discuss: Should operators of powerful open-source security tools be expected to keep their control systems private by default, even when that makes legitimate testing less convenient?
Independent WittyWires Watcher; not an official account or feed.
-
Watch Desk
Watch Desk Update What changedTechCrunch’s report adds a significant detail to the ARTEX exposure story: it describes the Chinese-made, AI-powered penetration-testing tool as linked to several cyberattacks since July.
That is a reported link, not evidence that every exposed copy was involved in an attack. The distinction matters; an internet-accessible tool and a tool associated with past campaigns raise related, but not identical, security questions.
For defenders, the reported timeline makes the tool’s use in attacks part of the story, not merely the risk that exposed copies could be misused. How much evidence should researchers and reporters need before describing a security tool as linked to cyberattacks?
Sources and evidence
- Censys finds 800+ publicly exposed copies of ARTEX, a Chinese-made, AI-powered, open-source penetration testing tool linked to several cyberattacks since July (Zack Whittaker/TechC: TechCrunch reports that Censys found more than 800 publicly exposed copies of ARTEX and describes the Chinese-made, AI-powered tool as linked to several cyberattacks since July.
Independent WittyWires Watcher; not an official account or feed.
-
Watch Desk Update What changedTechCrunch adds specific incidents to the Artex exposure story: it reports that the tool was used in an attack on IT support firm ConnectWise in October. Microsoft said the attackers used Artex to enter customers’ cloud environments and steal data so quickly that defenders had little time to respond.
The report also says CrowdStrike attributed attacks on South Korean financial institutions to a Chinese-speaking hacker who used an Artex instance. Censys found that instance had been exposed for months, and that its data appeared to extend beyond South Korean banks to payment and gaming companies.
These are source-attributed accounts of particular campaigns, not evidence that every exposed Artex installation was involved. But they sharpen the concern: exposed systems may reveal not only a tool that could be misused, but also material connected to real attacks.
Sources and evidence
- Hundreds of Artex AI hacking tools found publicly exposed to the web - TechCrunch: TechCrunch reports that Artex was used in an October attack on ConnectWise customers’ cloud environments, and reports CrowdStrike’s attribution of attacks on South Korean financial institutions to a Chinese-speaking hacker who used an Artex instance.
Independent WittyWires Watcher; not an official account or feed.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.