[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbdoqQKoNVw6AWx2PjYLe3PugTqsV95xJTImw8LposXM":3},{"article":4,"iocs":57,"watch_terms":60,"solutions":61,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"ab8f5a42-1066-4f83-b222-f487c1a0a86d","Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns","hacking-on-autopilot-inside-artex-cybercrime-campaigns-51adce","Key Points Introduction ARTEX is a Chinese open-source, AI-powered penetration testing platform designed to help security teams assess systems they own or are authorized to test. It uses large language models (LLMs) to coordinate multiple AI agents that plan tests, run security tools, and record evidence of potential vulnerabilities. Its web dashboard brings together assets, […] The post Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns appeared first on Check Point Research.","The AI-powered penetration testing platform ARTEX, originally designed for security teams, is now being widely used by cybercriminals for autonomous attacks. Check Point Research found over 1,800 exposed instances of ARTEX, with threat actors setting initial goals and allowing AI agents to autonomously discover and exploit vulnerabilities, primarily for financially motivated cybercrime. The platform's open-source nature and ease of use have led to its adoption by actors with limited technical expertise, enabling attacks at unprecedented speed and scale, including supply chain compromises.","AI-powered hacking platform ARTEX observed in widespread cybercrime campaigns.","https:\u002F\u002Fresearch.checkpoint.com\u002F2026\u002Fhacking-on-autopilot-inside-artex-cybercrime-campaigns\u002F","https:\u002F\u002Fresearch.checkpoint.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fartex_background.png","2026-11-05T17:22:06+00:00","2026-11-05T18:00:21.674278+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"ARTEX","product",{"name":21,"type":22},"AI agents","technology",{"name":24,"type":22},"LLMs",{"name":26,"type":19},"Deepseek Flash",{"name":28,"type":19},"CyberStrike",{"name":30,"type":19},"Cairn","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[58],{"type":56,"value":18,"context":59},"AI-powered penetration testing platform used in cybercrime campaigns",[18,26,28],{"controls":62,"vendors":146},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":93,"name":94,"problem":95,"products":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":51,"name":122,"problem":123,"products":124},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":142,"product_name":143,"url":144,"description":145},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"ai-pentesting-tool-artex-weaponized-for-autonomous-cybercrime-at-scale","AI Pentesting Tool ARTEX Weaponized for Autonomous Cybercrime at Scale","ARTEX, an open-source AI-powered penetration testing platform, has been repurposed by cybercriminals who are exploiting over 1,800 publicly exposed instances to conduct autonomous, goal-directed attacks with minimal human involvement. The root problem is twofold: organizations failed to secure or restrict access to a powerful dual-use tool, and the platform's low barrier to entry has democratized sophisticated attack capabilities for even low-skill threat actors. This matters because AI-driven automation compresses the attack lifecycle dramatically, leaving defenders far less time to detect and respond. The inclusion of supply chain compromise as an attack vector means the blast radius extends well beyond individual victims.",[158,159,160,161,162,163,164],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 7: Continuous Vulnerability Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":166,"MITRE ATT&CK T1566: Phishing":167,"CIS Control 17: Incident Response Management":168,"CIS Control 7: Continuous Vulnerability Management":169,"CIS Control 1: Inventory and Control of Enterprise Assets":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 mandates incident handling and risk management measures proportionate to the threat landscape; the autonomous, AI-driven nature of ARTEX campaigns raises the baseline risk organizations must account for in their security programs.","While ARTEX automates exploitation, the campaigns also include supply chain compromise vectors; understanding the full ATT&CK chain helps defenders map and anticipate the progression of AI-assisted attacks beyond initial access.","The unprecedented speed of AI-autonomous attacks means traditional manual incident response timelines are insufficient; organizations need pre-planned, rehearsed playbooks capable of matching machine-speed attack progression.","Routine vulnerability scanning of internet-facing assets would have flagged unauthenticated or misconfigured ARTEX instances before threat actors could leverage them for autonomous attacks.","Over 1,800 ARTEX instances were exposed because organizations lacked visibility into what tools were running on their infrastructure; a complete, continuously maintained asset inventory would have surfaced these deployments for remediation.","This control requires organizations to identify and remediate technical vulnerabilities in a timely manner, which would encompass insecure configurations of powerful dual-use tools like ARTEX.","Exposed ARTEX instances lacked proper authentication controls; enforcing identity-based access would have prevented unauthorized threat actors from commandeering the platform."]