Check Point Research has identified more than 1,600 publicly exposed instances of the ARTEX platform, an AI-powered penetration testing tool originating from China. The platform is designed for security assessments and allows for fully autonomous attacks after initial setup by an operator.
Threat actors have been observed using ARTEX primarily for financially motivated cybercrime, including cryptocurrency theft and Denial-of-Service attacks.
Instances of ARTEX have been found running in default configurations, often exposing administrative interfaces to the internet for remote access. Ten instances were misconfigured to expose the full ARTEX database.
The ARTEX platform's developer decided to make the project closed-source on October 8, 2026, potentially limiting future public exposure.
One operator of ARTEX reportedly targeted gray-market signing shops to steal code-signing certificates, working through 36 billion tokens over a two-week period.