~45 Open-Source AI Hacking Frameworks Mapped; Hundreds of Agent Attack Consoles Exposed Online (ARTEX Family)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5758 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX MySQL general_log JSP Webshell Technique

Detects MySQL/MariaDB statements that enable the general query log and repoint general_log_file, the technique GTIG observed ARTEX using to write JSP webshells (cl1217.jsp, f1219a.jsp, z1219.jsp) into web-served directories. TL-2026-5758. Flags statements whose log target has a script extension. Legitimate DBAs rarely point the general log at a .jsp/.php file.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1505.003, T1190
• Data sources: mysql_general_query_log, linux_syslog, defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=database (sourcetype="mysql:generalQueryLog" OR sourcetype="mysql:queryLog") earliest=-24h general_log
| eval raw_lc=lower(_raw)
| where like(raw_lc,"%set global%general_log%")
| eval webshell_path=if(match(raw_lc,"general_log_file.*[.](jsp|jspx|php|aspx?)"),"yes","no"), known_artex_name=if(match(raw_lc,"(cl1217|f1219a|z1219)[.]jsp"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen values(webshell_path) as webshell_path values(known_artex_name) as known_artex_name values(raw_lc) as statements by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen host count webshell_path known_artex_name statements

Microsoft KQL

let lookback = 24h;
union isfuzzy=true
  (Syslog
    | where TimeGenerated > ago(lookback)
    | where SyslogMessage has "general_log"
    | project TimeGenerated, Computer, Source=ProcessName, Statement=SyslogMessage),
  (DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("mysql", "mysql.exe", "mariadb", "mariadb.exe")
    | where ProcessCommandLine has "general_log"
    | project TimeGenerated=Timestamp, Computer=DeviceName, Source=InitiatingProcessFileName, Statement=ProcessCommandLine)
| where Statement matches regex @"(?i)set[ ]+global[ ]+general_log"
| extend WebshellPath = Statement matches regex @"(?i)general_log_file.*[.](jsp|jspx|php|aspx?)"
| extend KnownArtexName = Statement matches regex @"(?i)(cl1217|f1219a|z1219)[.]jsp"
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Statements=make_set(Statement, 5) by Computer, WebshellPath, KnownArtexName
| order by WebshellPath desc, LastSeen desc

Sigma

title: MySQL General Log Redirected to Web-Served Script File (ARTEX JSP Webshell Technique)
id: 7b1f0c2e-5a41-4d8e-9c3a-2e6f1a9d4b10
status: experimental
description: Detects a MySQL/MariaDB client command line that enables the general query log and repoints general_log_file, the technique GTIG attributed to ARTEX for writing JSP webshells into web-served directories (TL-2026-5758).
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks
  - https://intel.threadlinqs.com
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial-access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/mysql'
      - '/mariadb'
  selection_cli:
    CommandLine|contains|all:
      - 'set global'
      - 'general_log'
  condition: all of selection_*
falsepositives:
  - DBA temporarily enabling the general log for troubleshooting (the log path will not be a web script extension)
level: high

Known false positives:

• DBA enabling the general log for troubleshooting, typically to a .log path outside web roots
• Database migration or audit tooling that toggles general_log

Tuning notes: Treat webshell_path=yes or known_artex_name=yes as high-fidelity. Exclude documented DBA change windows and service accounts. Adjust index/sourcetype to wherever the MySQL general log is ingested; if it is not logged, rely on the command-line (KQL/Sigma) forms.

• 🔒 Inbound Access to Exposed AI Offensive-Framework Consoles (PentAGI, Agent Zero, ScopeWeaver, Pojun, Xalgorix) · unlock with TL Creds
• 🔒 ARTEX Persistence: Accounts Created or Modified with ArtexProbe Marker · unlock with TL Creds
• 🔒 ARTEX Cloud Permission Probing: AWS DryRun and Azure deployments/validate Bursts · unlock with TL Creds
• 🔒 Secret-Scanner and Offensive-Framework Execution on Servers (gitleaks, trufflehog, secret_scan, HexStrike) · unlock with TL Creds
• 🔒 JSP Webshell Written by Database Process or Matching ARTEX Filenames · unlock with TL Creds
• 🔒 WinRM Remote Execution: wsmprovhost.exe Spawning Shells and Recon Utilities · unlock with TL Creds
• 🔒 ARTEX Active Directory Credential Access: DCSync and Kerberoasting · unlock with TL Creds
• 🔒 ARTEX C2 and Exfiltration Egress: [indicator], [indicator] and Community Sibling Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-5758.

Sample indicators (3 of 19)

• IP address: 38.244.50[.]120
• Domain: xcai[.]pro
• Domain: webhook[.]site

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

Technical analysis

GitGuardian's research (reported by GBHackers on 2026-11-11) maps about 45 open-source agentic offensive frameworks. 32 are sorted into five families: network kill-chain tools (PentAGI, RedAmon, Xalgorix, DarkMoon, AIRecon and others), web/API tools (Strix, Shannon, PentestGPT), C2-integrated projects (Sage and echidna for Mythic; Pojun, FORANG, ycode and ScopeWeaver as ARTEX derivatives; virga), harnesses that wrap a general coding agent (RAPTOR, Cybermes, CyberStrike, Nebula) and research prototypes (Incalmo, hackingBuddyGPT, VulnBot, HackSynth, AutoPT). About 13 more are forks or variants. Cairn, HexStrike (an MCP server exposing 150+ tools) and Agent Zero appear in threat reporting and ship with no authentication by default.

ARTEX is a Go-based, multi-agent, LLM-driven pentest and offensive C2 platform with an embedded Next.js console and six sub-agents. Sources differ on the timeline: Check Point says the original repository was deleted on 2026-09-08 and the project went closed-source on 2026-10-08; GitGuardian counts the takedown on 2026-10-08, 74 days after the first commit, and 102 ARTEX-named repositories and forks appeared that week. Forks and backups remain public, and a commercial 'ARTEX PRO' and forks such as ScopeWeaver circulate. Google Threat Intelligence Group (GTIG) reports multiple actors abusing ARTEX, HexStrike and CAIRN in incident response engagements, including UNC7228 (overlapping Microsoft's Storm-0940, PRC-nexus) and financially motivated extortion groups. CrowdStrike reported an unattributed, likely Chinese-speaking, financially motivated actor using ARTEX against South Korean financial organizations in late September to early October 2026. Check Point identified 2,557 systems that hosted ARTEX panels, 1,608 of them live, and read the databases of 10 exposed servers (400,791 agent messages) showing campaigns against iOS signing-certificate shops, payment sites and gaming-account sites.

Observed ARTEX tradecraft (GTIG) includes cloud permission probing with DryRun and ARM deployments/validate calls, Kudu/SCM command execution, script staging pulled with curl and posted back across 491 rotating webhook.site URLs, Kerberoasting, DCSync, AD CS template auditing, WinRM/Pass-the-Hash/Pass-the-Ticket attempts, creation of admin accounts and cloud jump hosts, and a MySQL general_log technique that writes JSP webshells into web-served directories. Check Point also lists hardcoded admin passwords in front-end JavaScript, missing API authentication, command injection, IDOR and SSTI as entry points.

Exposure (Shodan, count-only, 2026-11-07, 41 frameworks fingerprinted, 11 serve a web UI by default): ARTEX family 1,428; PentAGI 419 (233 on its default certificate; ports 8443, 8666, 8765); Agent Zero 173 (134 behind login, 39 open; ports 5080, 50080); ScopeWeaver 43 (8787); Cairn 41 (8000); RedAmon 27 (3000, 443); Strix 13 (8080); Pojun 11 (8787); Xalgorix 6 (9137). Four tools wire a real secret scanner to the agent (Pojun, Cybermes, Xalgorix, AIRecon); none ships a full GitHub-to-secret pipeline, but an agent with shell and web access can assemble one at runtime. Caveat: Exploitation is confirmed only for ARTEX (and reported appearances of Cairn, HexStrike); no CVEs are involved and the source does not publish target lists. Some details come from secondary summaries of the Check Point and CrowdStrike reports.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.006 OS Credential Dumping: DCSync; T1110.003 Brute Force: Password Spraying; T1552.001 Unsecured Credentials: Credentials In Files; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Lateral Movement

T1021.006 Remote Services: Windows Remote Management; T1550.002 Use Alternate Authentication Material: Pass the Hash

Execution

T1059.001 Command and Scripting Interpreter: PowerShell

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation; T1136 Create Account; T1505.003 Server Software Component: Web Shell

Collection

T1530 Data from Cloud Storage

Exfiltration

T1567 Exfiltration Over Web Service

defense-impairment

T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance

Discovery

T1580 Cloud Infrastructure Discovery

Reconnaissance

T1593.003 Search Open Websites/Domains: Code Repositories; T1595.003 Active Scanning: Wordlist Scanning

Remediation

Immediate actions

• Inventory internet-facing agent consoles and MCP servers (PentAGI, Agent Zero, Cairn, HexStrike, ScopeWeaver, RedAmon, Pojun, Xalgorix, Strix) on their default ports and shut down or firewall unintended ones
• Rotate any credential or key found in a public repository
• Alert on egress to webhook.site and other OAST or public file-sharing hosts from servers that do not normally contact them
• Alert on MySQL SET GLOBAL general_log / general_log_file statements and new .jsp files in web roots

Workarounds

• Place agent consoles behind VPN or an authenticating reverse proxy
• Block known default ports from the internet at the perimeter

Longer-term hardening

• Enforce authentication on every operator UI and MCP server; do not keep default no-auth configurations
• Restrict outbound GitHub access, shell access and credential scope on agent hosts
• Replace long-lived cloud keys with managed identities and workload federation; restrict SCM/Kudu and admin control planes to trusted networks
• Add rate and recipient limits to email, user-creation and credential-access functions; harden AD CS and enforce SMB/LDAP signing
• Baseline identity velocity (DryRun and deployments/validate bursts, rapid create/delete) and correlate identity, control-plane and network telemetry

Affected and fixed versions

• VXControl — PentAGI
  Vulnerable versions: internet-exposed consoles, 233 on default certificate
• Agent Zero — Agent Zero
  Vulnerable versions: no authentication by default; 39 open consoles
• Cairn — Cairn
  Vulnerable versions: no authentication by default
• HexStrike — HexStrike MCP server
  Vulnerable versions: no authentication by default
• Autumn-27 — ARTEX and derivatives (ScopeWeaver, Pojun, FORANG)
  Vulnerable versions: exposed consoles and databases

Timeline

• 2026-07-26 Approximate ARTEX first commit, derived from GitGuardian's statement that the takedown came 74 days after the first commit on 2026-10-08.
• 2026-09-08 Per Check Point, the original ARTEX repository was deleted and forks followed.
• 2026-10-07 CrowdStrike published its report on an unattributed actor using ARTEX against South Korean financial organizations (activity late September to early October).
• 2026-10-08 ARTEX developer pulled the project or made it closed-source; 102 ARTEX-named repositories and forks appeared in the takedown week.
• 2026-10-14 Check Point-observed ARTEX campaign against 10 gray-market iOS signing shops began (ran to 2026-10-29).
• 2026-10-20 Pojun added gitleaks to its worker prompt; a default skill pointing the agent at public GitHub followed on 2026-11-05.
• 2026-11-05 Check Point published research on 1,608 live ARTEX servers and 400,791 agent messages read from 10 exposed databases.
• 2026-11-07 GitGuardian's Shodan count: ARTEX family 1,428 services, PentAGI 419, Agent Zero 173, ScopeWeaver 43, Cairn 41, RedAmon 27.
• 2026-11-11 GBHackers reported GitGuardian's mapping of about 45 open-source AI hacking frameworks.

Sources cited

• GitGuardian: AI pentesting tools beyond ARTEX blog.gitguardian.com · Research
• GTIG: ARTEX and Friends Enter Agentic Offensive Frameworks Google Cloud · Vendor report
• CrowdStrike: Unknown Threat Actor Uses ARTEX to Target South Korean Finance CrowdStrike · Vendor report · 2026-10-07
• Check Point ARTEX research summary: 1,608 live servers, 400,791 agent messages explainx.ai · Research · 2026-11-05
• Researchers Uncover 45 AI Hacking Frameworks, With Hundreds of Attack Consoles Exposed on the Internet gbhackers.com · News · 2026-11-11
• GBHackers: ARTEX AI agents gbhackers.com · News
• Censys finds 1,465 exposed hosts running ARTEX AI pentesting framework letsdatascience.com · News
• BleepingComputer: Chinese hackers use ARTEX AI in automated attacks against 200 orgs BleepingComputer · News
• eSecurityPlanet: ARTEX Cyberattacks: AI Agents Steal Credentials and Signing Certificates esecurityplanet.com · News

More in threat intel

• School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)
• Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709
• Lazarus: Weight-Space Backdoor Technique Hidden in Dormant AI Model Neurons (Microsoft Research)
• QuoIntelligence Weekly Snapshot W39 2026: ClickFix/Exvicy, Graphalgo Go RAT, RemControl Android trojan, Windows Defender zero-day exploit (Nightmare Eclipse)
• CRAFTY FALCON: AI-Assisted Financial Threat Actor Targeting Indian BFSI (CERT-In CIAD-2026-0058)

More from Storm-0940

• ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions
• ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data Theft
• Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise/SkyKick OAuth Supply-Chain Compromise of Microsoft 365 Tenants

Previous and next in threat intel

• Vulnerability backlog risk: nearly half of large-enterprise security teams close or deprioritize unverified findings (ProjectDiscovery survey) Previous report