{"id":"CMP-202611-57y43e","kind":"campaign","aliases":[],"related":["CMP-202610-china-linked-vapor-panda-uses-the-artex-ai-agent-framework-t"],"title":"Cybercriminals run the ARTEX AI hacking tool almost on autopilot to break into web apps and steal credentials, crypto and iOS signing certificates; 1,600+ live consoles (Check Point)","description":null,"summary":"Check Point Research (5 Nov 2026) found 2,557 servers hosting or having hosted ARTEX, an AI agent pentest platform that its developer took private in October; forks keep it available. 1,608 were live and public (US 882, Hong Kong 295, China 103). Ten exposed their databases and show financially motivated, opportunistic operators who set a goal and let the agents run almost on their own, mostly on DeepSeek Flash and Kimi models, through residential proxies. From 14 to 29 Oct 2026 one operator broke into 10 grey-market iOS signing shops and stole 300+ .p12 certificates with passwords. Another tasked agents against 292 crypto payment domains, gambling sites, card shops, OTC desks and custody backends to drain USDT and swap deposit addresses. That attempt failed, but along the way an unauthenticated API leaked AWS S3 keys, and the agent overwrote an iOS app manifest.plist in a public bucket (the owner restored it). A third operator took about 190,000 Honor of Kings account logins (about 6,000 still valid) from 13 game account shops. Entry methods: admin passwords hardcoded in front-end JavaScript bundles, web APIs with no authentication, command injection, SSTI, IDOR and weak admin passwords. No new CVE. The named victims are grey-market and crypto sites, but Check Point warns that any internet-facing web app can get this kind of high-volume testing. This is separate from the VAPOR PANDA and Storm-0940 ARTEX activity.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-05T17:55:47+00:00","products":[{"name":"ARTEX","fixed":[],"ecosystem":"other"},{"name":"Amazon S3","fixed":[],"affected":"buckets with keys leaked by app APIs","ecosystem":"aws"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Look in web, WAF and firewall logs for traffic from Check Point's ARTEX console clusters: 38.11.173.1-125, 38.11.221.1-125 and 198.200.59.85-89 (AS54600 PEG TECH, version tag sco-fix2); 103.122.245.194, .198, .199, .204, .214, .215, .216, .217, .218, .219 (AS152918 Liberally Network, Thailand); 192.236.172.197, 198.44.123.66, 204.44.66.81, 104.168.112.237 (AS36352 HostPapa, tag 0.3.15-pro.*). The agents work through residential proxies, so the attack traffic may come from other IPs.\\n- Search front-end JavaScript bundles and HTML for hardcoded admin passwords and keys, and check for web APIs that answer without authentication.\\n- Check for public files in the web root that hold credentials, and for API responses that return cloud keys such as AWS S3 credentials.\\n- If you publish iOS apps or landing pages from S3: check the bucket's write permissions and look for unexpected changes to manifest.plist, .ipa or index.html files.\\n- Look for long, steady, broad scanning of every endpoint (AI agent testing).\\n- Hashes and attacker wallet addresses: not published.","fix":"- Remove hardcoded credentials from front-end code, rotate any that were shipped, and require authentication on every web and admin API.\\n- Rotate cloud keys that any API or web response has exposed, and make S3 buckets that serve downloads read-only to the public.\\n- Patch command injection and template injection issues, and replace weak or default admin passwords.\\n- Block or alert on the listed IP ranges, and rate-limit or challenge long automated scans.\\n- If you hold Apple enterprise signing certificates, keep them and their passwords out of web-reachable databases, and revoke any that may have been exposed.","status":"open","published_at":null,"first_seen_at":"2026-11-05T17:55:47+00:00","triaged_at":"2026-11-05T17:55:47+00:00","updated_at":"2026-11-05T17:56:39+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-0940':287B '-202611':31A '-57':32A '000':205B,213B '1':24A,75B '10':131B '103':87B '13':217B '14':122B '190':204B '2':51B '2026':49B,126B '29':124B '292':149B '295':85B '300':140B '5':47B '557':52B '6':212B '600':25A '608':76B '882':82B 'account':209B,219B 'activ':289B 'address':168B 'admin':223B,243B 'agent':61B,105B,147B,185B 'ai':5A,60B 'almost':8A,107B 'along':173B 'amazon':38A 'anoth':145B 'api':178B,233B 'app':15A,189B,268B 'artex':4A,34A,35A,37A,58B,288B 'attempt':170B 'authent':236B 'autopilot':10A 'avail':74B 'aw':180B 'backend':161B 'break':12A 'broke':129B 'bucket':194B 'bundl':231B 'campaign':40B 'card':155B 'certif':23A,142B 'check':28A,44B,259B 'china':86B 'cmp':30A 'command':237B 'consol':27A 'credenti':18A 'crypto':19A,150B,256B 'custodi':160B 'cve':247B 'cybercrime':36A 'cybercrimin':1A 'databas':91B 'deepseek':113B 'deposit':167B 'desk':158B 'develop':66B 'domain':152B 'drain':163B 'earli':42B 'early-warn':41B 'end':229B 'entri':221B 'expos':89B 'face':266B 'fail':171B 'financi':94B 'flash':114B 'fork':71B 'found':50B 'front':228B 'front-end':227B 'gambl':153B 'game':218B 'get':270B 'goal':101B 'grey':133B,253B 'grey-market':132B,252B 'hack':6A 'hardcod':225B 'high':275B 'high-volum':274B 'hong':83B 'honor':206B 'host':54B,57B 'idor':240B 'inject':238B 'internet':265B 'internet-fac':264B 'io':21A,135B,188B 'javascript':230B 'keep':72B 'key':182B 'kimi':116B 'kind':272B 'king':208B 'kong':84B 'leak':179B 'let':103B 'live':26A,78B 'login':210B 'manifest.plist':190B 'market':134B,254B 'method':222B 'model':117B 'most':111B 'motiv':95B 'name':249B 'new':246B 'nov':48B 'oct':125B 'octob':70B 'one':127B 'oper':97B,128B,201B 'opportunist':96B 'otc':157B 'overwrot':186B 'owner':196B 'p12':141B 'panda':284B 'password':144B,224B,244B 'payment':151B 'pentest':62B 'platform':63B 'point':29A,45B,260B 'privat':68B 'proxi':120B 'public':80B,193B 'research':46B 'residenti':119B 'restor':197B 'run':2A,106B 's3':39A,181B 'separ':280B 'server':53B 'set':99B 'shop':137B,156B,220B 'show':93B 'sign':22A,136B 'site':154B,257B 'ssti':239B 'steal':17A 'still':214B 'stole':139B 'storm':286B 'swap':166B 'task':146B 'ten':88B 'test':277B 'third':200B 'took':67B,202B 'tool':7A 'unauthent':177B 'us':81B 'usdt':164B 'valid':215B 'vapor':283B 'victim':250B 'volum':276B 'warn':43B,261B 'way':175B 'weak':242B 'web':14A,232B,267B 'y43e':33A","nicknames":["ARTEX","ARTEX cybercrime"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["amazons3","artex","artexcybercrime","s3"],"ptokens":["amazon","artex","s3"],"labels":["campaign","earlywarning","high","infrastructure"],"campaign_type":"exploitation","first_public_at":"2026-11-05T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-57y43e","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-05T17:55:47+00:00","fetched_at":"2026-11-05T17:55:47+00:00","note":null}],"documents":[{"id":78217,"url":"https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/","title":"Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns (Check Point Research)","kind":"blog","source":"blog","publisher":null,"text":"Check Point Research: 2,557 systems hosting/hosted ARTEX panels, 1,608 live public instances (US 882, HK 295, CN 103); 10 exposed full DBs. Financially motivated operators run near-fully autonomous agents (mostly DeepSeek Flash, Kimi K3.1 Pro; guardrails only hit on Anthropic Opus 5.5). Campaign 1 (2026-10-14 to 10-29): 10 grey-market iOS signing shops hacked for .p12 certs+passwords (300+ stolen, 3 valid) via hardcoded admin passwords in SPA JS bundles, unauthenticated web APIs, command-injection RCE, IDOR, weak admin creds, SSTI RCE. Campaign 2: 292 crypto payment domains tasked to drain USDT and swap deposit addresses; gambling, card shops, OTC desks, custody backends; unauthenticated API leaked AWS S3 creds giving write to a bucket of iOS IPA landing pages, manifest.plist rewritten (restored by owner); no funds moved. Campaign 3: 13 grey-market game account shops, plaintext creds in static web-root file, 190,000 Honor of Kings creds (~6,000 valid). Agents use residential proxies. Clusters by version tag: sco-fix2 on 38.11.173.1-125, 38.11.221.1-125, 198.200.59.85-89 (AS54600 PEG TECH); dev-db-resilience-20261031 style tags on 103.122.245.194,.198,.199,.204,.214-.219 (AS152918 Liberally Network, TH); 0.3.15-pro.* on 192.236.172.197, 198.44.123.66, 204.44.66.81, 104.168.112.237 (AS36352 HostPapa). Other frameworks: CyberStrike, Cairn, PentAGI, custom PZZ.","published_at":"2026-11-05T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}