Hundreds of exposed Artex AI hacking tools are reachable from the web without passwords
Dozens of copies of the open-source code remain online, so the tool can still be used in live attacks even as its maker moves to closed source.
Security researchers at Censys identified more than 800 deployments of Artex, an open-source autonomous penetration testing tool made in China, that could be reached over the web without a password. The tool has been tied to several attacks, including one on the Korean finance sector in September and another on IT support provider ConnectWise earlier in October that let Chinese-linked hackers reach data hosted in Microsoft's cloud. Many of these intrusions relied on basic weaknesses such as weak or known passwords and missing multi-factor authentication. Artex has since said it will move to closed-source, but dozens of copies of its code remain on code-sharing sites and can still be used in live attacks.
Why it matters
The exposure matters most to organisations running these deployments, which can be reached without a password and have already been used in attacks on finance and cloud environments. Many of those intrusions came down to weak or known passwords and missing multi-factor authentication, so the risk lies as much in basic account security as in the tool itself. Because copies of the code remain on public code-sharing sites, the tool stays available to anyone who wants to use it, regardless of Artex's decision to go closed source.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.