ARTEX AI-Powered Pentest Platform Abused for Autonomous Cybercrime Campaigns (Apple Certificates, Crypto Draining, Gaming Credentials)

Key facts for ARTEX autopilot cybercrime

Detection coverage for ARTEX autopilot cybercrime

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5335 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX Autonomous Agent Web Exploitation — Command Injection / SSTI Burst (T1190)

Detects a single client IP that sends web requests carrying OS command-injection or server-side template-injection payloads (';id', '&&whoami', '$(...)', '/etc/passwd', '{{...}}', '${...}', '<%=...%>') combined with high request volume, broad URI coverage, or both payload classes together. This is the behavioural footprint of ARTEX LLM agents (TL-2026-5335) testing gray-market certificate shops, crypto payment back-ends and game-credential servers for command-injection RCE and SSTI (T1190, T1595.002) with minimal operator interaction. Behaviour-first: no IOC dependency, so it also catches forks and operators on residential proxies.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595.002
• Data sources: splunk:index=web sourcetype=access_combined, sentinel:W3CIISLog, sigma:webserver
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined earliest=-24h
| eval req=urldecode(uri)
| eval cmdi=if(match(req,"(?i)(;|&&)\\s*(id|whoami|uname|wget|curl)\\b|/etc/passwd|[$][(][a-z0-9 ./_-]*[)]"),1,0)
| eval ssti=if(match(req,"(?i)[{][{][^}]*[}][}]|[$][{][^}]*[}]|<%=?[^%]*%>|#[{][^}]*[}]"),1,0)
| stats count AS requests dc(uri) AS distinct_uris sum(cmdi) AS cmdi_hits sum(ssti) AS ssti_hits values(status) AS statuses min(_time) AS first_seen max(_time) AS last_seen BY clientip
| where (cmdi_hits+ssti_hits)>=1 AND (requests>=100 OR distinct_uris>=50 OR (cmdi_hits>=1 AND ssti_hits>=1))
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table clientip requests distinct_uris cmdi_hits ssti_hits statuses first_seen last_seen

Microsoft KQL

W3CIISLog
| where TimeGenerated > ago(24h)
| extend req = url_decode(strcat(csUriStem, "?", csUriQuery))
| extend cmdi = iff(req matches regex @"(?i)(;|&&)\\s*(id|whoami|uname|wget|curl)\\b|/etc/passwd|\\$\\([a-z0-9 ./_-]*\\)", 1, 0),
         ssti = iff(req matches regex @"(?i)\\{\\{[^}]*\\}\\}|\\$\\{[^}]*\\}|<%=?[^%]*%>|#\\{[^}]*\\}", 1, 0)
| summarize requests = count(), distinct_uris = dcount(csUriStem), cmdi_hits = sum(cmdi), ssti_hits = sum(ssti),
            statuses = make_set(scStatus, 10), first_seen = min(TimeGenerated), last_seen = max(TimeGenerated) by cIP
| where (cmdi_hits + ssti_hits) >= 1 and (requests >= 100 or distinct_uris >= 50 or (cmdi_hits >= 1 and ssti_hits >= 1))
| project cIP, requests, distinct_uris, cmdi_hits, ssti_hits, statuses, first_seen, last_seen

Sigma

title: ARTEX Agent Web Exploitation - Command Injection and SSTI Payloads in Requests
id: 7c1e4a52-3b9d-4f6a-9a1e-5d2f0c8b6e11
status: experimental
description: Detects web requests carrying OS command-injection or server-side template-injection payloads, the exploitation pattern used by ARTEX LLM agents against exposed web applications (TL-2026-5335).
references:
    - https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.initial-access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595.002
logsource:
    category: webserver
detection:
    selection_ssti:
        cs-uri-query|contains:
            - '{{7*7}}'
            - '${7*7}'
            - '<%=7*7%>'
            - '#{7*7}'
            - '%7B%7B7*7%7D%7D'
    selection_cmdi:
        cs-uri-query|contains:
            - ';id;'
            - ';whoami'
            - '&&whoami'
            - '%3Bid%3B'
            - '%3Bwhoami'
            - '$(id)'
            - '$(whoami)'
            - '/etc/passwd'
    condition: 1 of selection_*
falsepositives:
    - Authorized penetration tests or DAST scanners against the web application
    - Developer documentation or template-engine sites that legitimately pass template syntax in query strings
level: high

Known false positives:

• Authorized DAST/penetration-test scanners (Burp, ZAP, Nessus) hitting production
• Documentation or templating portals that legitimately echo '{{ }}' or '${ }' in URLs

Tuning notes: Allowlist scanner source IPs and pentest windows. Raise the requests/distinct_uris thresholds for high-traffic public sites. Swap sourcetype for nginx/IIS equivalents (e.g. ms:iis:auto) and pair with WAF logs to see blocked attempts.

• 🔒 ARTEX Agent Unauthenticated API Object Enumeration — IDOR / Missing Authentication Sweep · unlock with TL Creds
• 🔒 ARTEX S3 Credential Abuse — IPA Manifest Write and Bulk Bucket Read (T1530 / T1565.001 / T1195.002) · unlock with TL Creds
• 🔒 ARTEX Operator LLM API Reseller and Agent Session Exposure — [indicator] / Claude Memory Open Directory · unlock with TL Creds
• 🔒 ARTEX Credential Harvest — Plaintext Credential and Certificate File Retrieved From Web Root (T1552.001) · unlock with TL Creds
• 🔒 ARTEX Host-Level Hunting for Signing Certificates and Credentials (find/grep/tar on .p12, .mobileprovision, passwords) · unlock with TL Creds
• 🔒 ARTEX Operator Proxy Infrastructure — Inbound Web Requests From Known ARTEX Campaign Proxies (T1090.002) · unlock with TL Creds
• 🔒 ARTEX Post-Exploitation — Web Server Process Spawning Shell and Linux Privilege-Escalation Recon · unlock with TL Creds
• 🔒 ARTEX C2 Dashboard Infrastructure — Network Communication with Known Exposed ARTEX Hosts (T1588.007) · unlock with TL Creds

Indicators of compromise for ARTEX autopilot cybercrime

As of 2026-11-05, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-5335.

Sample indicators (3 of 27)

• IP address: 198.200.59[.]85
• Domain: xcai[.]pro
• IP address: 103.122.245[.]194

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

How ARTEX autopilot cybercrime works

ARTEX is a Chinese open-source agentic penetration testing platform (developer: Autumn-27) built around a web dashboard that coordinates multiple LLM-driven agents. The agents plan tests, run security tools and record vulnerability evidence, and operate almost entirely autonomously once given a goal. The developer closed the source on 2026-10-08 after public reports of misuse, but forks remain publicly available. Check Point Research identified 2,557 historical ARTEX command-and-control (C&C) dashboards, of which 1,608 were live and publicly exposed (USA 882, Hong Kong 295, China 103), with a spike in new deployments in mid-October 2026 after public reporting.

Campaign 1 (Apple certificate heist, 2026-10-14 to 2026-10-29): operators pointed ARTEX agents, driven by Deepseek v4.1 Flash and Kimi K3.1 Pro (about 36 billion tokens, estimated $700-$1,500), at 10 gray-market iOS code-signing certificate shops. Agents exploited hardcoded admin passwords in SPA JavaScript bundles, unauthenticated web APIs, command-injection RCE, IDOR, weak administrative credentials, server-side template injection, and Linux privilege escalation through overly permissive folder access. More than 300 .p12 certificates and provisioning profiles were recovered and 3 were validated as usable for signing iOS apps. Operator prompting was minimal (21 interactions in Chinese, mostly progress queries).

Campaign 2 (crypto draining, 4 days): Deepseek v4 Pro (about 167.5 million tokens, $145-$300) was tasked to penetrate 292 crypto payment infrastructure domains, drain USDT and backdoor payment systems by configuring an attacker wallet as receiver. Agents self-identified gambling sites, slot platforms, card shops, OTC desks and custody backends, then targeted a TRON wallet holding about $600,000. They found an unauthenticated API exposing AWS S3 credentials with write access to a bucket holding 714 iOS enterprise-signed IPA landing pages and distribution manifests, and proposed poisoning the manifests for supply-chain IPA replacement. No USDT was obtained; the attacker wallet showed zero balance and transactions, and the bucket owners later remediated.

Campaign 3 (gaming account theft, about 5 days): Deepseek-V4.1-Flash (about 1.9 billion cache-hit tokens, $180-$360) targeted 13 backend credential servers used by gray-market 'data account' infrastructure for Chinese mobile games. After reverse engineering related APKs, agents found plaintext credential files in web roots and hardcoded admin credentials in frontend JavaScript/HTML. They recovered more than 190,000 Honor of Kings credential sets, of which about 3.3% (roughly 6,000) were valid.

Evasion and tooling: operators used residential proxies to bypass WAFs and IP blocks (one operator built a dedicated agent 'skill' for proxy deployment). Check Point reports that Anthropic's model triggered guardrails and actors switched to permissive Chinese models under 'Pentest' framing. Similar agentic tools observed include CyberStrike, Cairn, PentAGI and a custom framework named PZZ. Related reporting links ARTEX to attacks on South Korean financial firms (CrowdStrike; Shinhan Bank, Yegaram Savings Bank; late Sept-early Oct 2026) and Japanese companies (GMO Cybersecurity by Ierae / JPCERT/CC). Those are separate operators using the same tool; no common actor is established.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1530 Data from Cloud Storage

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Defense Evasion

T1078 Valid Accounts

Initial Access

T1078.001 Valid Accounts: Default Accounts; T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Command and Control

T1090.002 Proxy: External Proxy

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Impact

T1565.001 Data Manipulation: Stored Data Manipulation; T1657 Financial Theft

Resource Development

T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation for ARTEX autopilot cybercrime

Immediate actions

• Block or monitor the ARTEX-associated IP ranges and proxy addresses listed in the IOCs at the perimeter
• Rotate any admin credentials, API keys and AWS access keys embedded in JavaScript bundles, HTML, APKs or plaintext files in web roots
• Audit S3 buckets for public or over-broad write access and revoke exposed credentials
• Review web and API logs for high-volume autonomous scanning, command injection, SSTI and IDOR probing patterns

Workarounds

• Restrict administrative interfaces to allowlisted networks or VPN
• Enable integrity controls on distribution manifests and IPA/app delivery buckets

Longer-term hardening

• Remove hardcoded credentials from client-side code and enforce authentication on every API endpoint
• Implement object-level authorization checks to prevent IDOR
• Deploy WAF rules for command and template injection and run regular authorized pentests of exposed perimeter systems
• Apply least-privilege file permissions on Linux hosts to block local privilege escalation
• Monitor for unusual LLM API consumption and agent-like traffic from residential proxy networks

Affected and fixed versions

• Various — Gray-market iOS code-signing certificate shops, crypto payment platforms and Chinese mobile game credential back-ends exposed to the internet
  Vulnerable versions: Instances with hardcoded credentials, unauthenticated APIs, IDOR, command injection or SSTI
• Autumn-27 — ARTEX (abused tool; 1,608 live exposed instances)
  Vulnerable versions: Open-source releases and forks (dev, sco-fix2, 0.3.15-pro.*)

Timeline of ARTEX autopilot cybercrime

• 2026-09-30 CrowdStrike-reported ARTEX-assisted intrusions against South Korean financial firms (Shinhan Bank, Yegaram Savings Bank) occur from late September into early October 2026; this is a separate operator from the Check Point campaigns.
• 2026-10-08 locked-ioc-26 developer (Autumn-27) converts the project to closed source and announces no further releases or maintenance; public forks remain available.
• 2026-10-14 Campaign 1 begins: locked-ioc-26 agents driven by Deepseek v4.1 Flash and Kimi K3.1 Pro attack 10 gray-market iOS code-signing certificate shops.
• 2026-10-15 Spike in new locked-ioc-26 C&C dashboard deployments from mid-October 2026 following public reporting of the tool's misuse.
• 2026-10-19 GMO Cybersecurity by Ierae discloses locked-ioc-26 use against about 20 Japanese companies; operators remain unidentified.
• 2026-10-29 Campaign 1 concludes with more than 300 iOS certificates recovered, 3 validated as usable for signing apps.
• 2026-10-31 locked-ioc-26 instance observed with version tag locked-ioc-2, indicating continued operator forking and development.
• 2026-11-05 Check Point Research publishes 'Hacking on Autopilot: Inside locked-ioc-26 Cybercrime Campaigns', documenting the three campaigns and 1,608 live exposed locked-ioc-26 instances.

Sources cited for ARTEX autopilot cybercrime

• Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns Check Point Research · Research · 2026-11-05
• ARTEX AI Pentesting Tool Used in Data Theft Attacks (The Hacker News) The Hacker News · News · 2026-10-01
• AI-Driven tool ARTEX used in attacks against South Korean Banks (Security Affairs) securityaffairs.com · News · 2026-10-01
• ARTEX AI Tool Linked to Cyberattacks on Japanese Companies (eSecurity Planet) esecurityplanet.com · News · 2026-10-19
• ARTEX Developer Closes AI Pentest Tool After Korea Bank Hacks aiweekly.co · News · 2026-10-08
• Recorded Future Links TAG-217 to ARTEX Activity Around South Korean Financial Attacks letsdatascience.com · News · 2026-10-15

More in threat intel

• Praetorian Brutus: Open-Source Multi-Protocol Credential Testing Engine Expands to 14 New Protocols with People Enumeration and Credential Persistence
• OpenAI releases GPT-6 Cyber, an offensive-capable AI model rated Critical under its Preparedness Framework
• OpenAI Finds GPT-6 Astra Covertly Underperforming on Safety Research and Exploit Tasks
• Module Overloading: Full PE Image Placed Inside a Carrier DLL Mapping (Malware Development Technique, cocomelonc)
• BOSSAI: AI-Augmented Multi-Agent Attack Campaign Exposes Taiwan Emergency Dispatch and Patient Records