# ~45 Open-Source AI Hacking Frameworks Mapped; Hundreds of Agent Attack Consoles Exposed Online (ARTEX Family)

> GitGuardian catalogued about 45 open-source frameworks that connect an LLM to a loop running offensive tools. After the ARTEX agentic pentest platform was pulled by its developer on 2026-10-08, ARTEX-family consoles matched 1,428 Shodan services on 2026-11-07, and PentAGI, Agent Zero, Cairn and others expose consoles that are unauthenticated or use default certificates.

- **Published:** 2026-11-11T12:01:25Z
- **Last reviewed:** 2026-11-11T12:01:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5758
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5758.png
- **ID:** TL-2026-5758
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Storm-0940 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

GitGuardian's research (reported by GBHackers on 2026-11-11) maps about 45 open-source agentic offensive frameworks. 32 are sorted into five families: network kill-chain tools (PentAGI, RedAmon, Xalgorix, DarkMoon, AIRecon and others), web/API tools (Strix, Shannon, PentestGPT), C2-integrated projects (Sage and echidna for Mythic; Pojun, FORANG, ycode and ScopeWeaver as ARTEX derivatives; virga), harnesses that wrap a general coding agent (RAPTOR, Cybermes, CyberStrike, Nebula) and research prototypes (Incalmo, hackingBuddyGPT, VulnBot, HackSynth, AutoPT). About 13 more are forks or variants. Cairn, HexStrike (an MCP server exposing 150+ tools) and Agent Zero appear in threat reporting and ship with no authentication by default.

ARTEX is a Go-based, multi-agent, LLM-driven pentest and offensive C2 platform with an embedded Next.js console and six sub-agents. Sources differ on the timeline: Check Point says the original repository was deleted on 2026-09-08 and the project went closed-source on 2026-10-08; GitGuardian counts the takedown on 2026-10-08, 74 days after the first commit, and 102 ARTEX-named repositories and forks appeared that week. Forks and backups remain public, and a commercial 'ARTEX PRO' and forks such as ScopeWeaver circulate. Google Threat Intelligence Group (GTIG) reports multiple actors abusing ARTEX, HexStrike and CAIRN in incident response engagements, including UNC7228 (overlapping Microsoft's Storm-0940, PRC-nexus) and financially motivated extortion groups. CrowdStrike reported an unattributed, likely Chinese-speaking, financially motivated actor using ARTEX against South Korean financial organizations in late September to early October 2026. Check Point identified 2,557 systems that hosted ARTEX panels, 1,608 of them live, and read the databases of 10 exposed servers (400,791 agent messages) showing campaigns against iOS signing-certificate shops, payment sites and gaming-account sites.

Observed ARTEX tradecraft (GTIG) includes cloud permission probing with DryRun and ARM deployments/validate calls, Kudu/SCM command execution, script staging pulled with curl and posted back across 491 rotating webhook.site URLs, Kerberoasting, DCSync, AD CS template auditing, WinRM/Pass-the-Hash/Pass-the-Ticket attempts, creation of admin accounts and cloud jump hosts, and a MySQL general_log technique that writes JSP webshells into web-served directories. Check Point also lists hardcoded admin passwords in front-end JavaScript, missing API authentication, command injection, IDOR and SSTI as entry points.

Exposure (Shodan, count-only, 2026-11-07, 41 frameworks fingerprinted, 11 serve a web UI by default): ARTEX family 1,428; PentAGI 419 (233 on its default certificate; ports 8443, 8666, 8765); Agent Zero 173 (134 behind login, 39 open; ports 5080, 50080); ScopeWeaver 43 (8787); Cairn 41 (8000); RedAmon 27 (3000, 443); Strix 13 (8080); Pojun 11 (8787); Xalgorix 6 (9137). Four tools wire a real secret scanner to the agent (Pojun, Cybermes, Xalgorix, AIRecon); none ships a full GitHub-to-secret pipeline, but an agent with shell and web access can assemble one at runtime. Caveat: Exploitation is confirmed only for ARTEX (and reported appearances of Cairn, HexStrike); no CVEs are involved and the source does not publish target lists. Some details come from secondary summaries of the Check Point and CrowdStrike reports.

## MITRE ATT&CK

- T1595.003 Active Scanning: Wordlist Scanning
- T1593.003 Search Open Websites/Domains: Code Repositories
- T1190 Exploit Public-Facing Application
- T1078.004 Valid Accounts: Cloud Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1505.003 Server Software Component: Web Shell
- T1136 Create Account
- T1098 Account Manipulation
- T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1003.006 OS Credential Dumping: DCSync
- T1552.001 Unsecured Credentials: Credentials In Files
- T1110.003 Brute Force: Password Spraying
- T1580 Cloud Infrastructure Discovery
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1021.006 Remote Services: Windows Remote Management
- T1530 Data from Cloud Storage
- T1071.001 Application Layer Protocol: Web Protocols
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ARTEX MySQL general_log JSP Webshell Technique** (`TL-2026-5758-SPL-001`)

Detects MySQL/MariaDB statements that enable the general query log and repoint general_log_file, the technique GTIG observed ARTEX using to write JSP webshells (cl1217.jsp, f1219a.jsp, z1219.jsp) into web-served directories. TL-2026-5758. Flags statements whose log target has a script extension. Legitimate DBAs rarely point the general log at a .jsp/.php file.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1505.003, T1190
- **Data sources:** mysql_general_query_log, linux_syslog, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=database (sourcetype="mysql:generalQueryLog" OR sourcetype="mysql:queryLog") earliest=-24h general_log
| eval raw_lc=lower(_raw)
| where like(raw_lc,"%set global%general_log%")
| eval webshell_path=if(match(raw_lc,"general_log_file.*[.](jsp|jspx|php|aspx?)"),"yes","no"), known_artex_name=if(match(raw_lc,"(cl1217|f1219a|z1219)[.]jsp"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen values(webshell_path) as webshell_path values(known_artex_name) as known_artex_name values(raw_lc) as statements by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen host count webshell_path known_artex_name statements
```

### Microsoft KQL

```kql
let lookback = 24h;
union isfuzzy=true
  (Syslog
    | where TimeGenerated > ago(lookback)
    | where SyslogMessage has "general_log"
    | project TimeGenerated, Computer, Source=ProcessName, Statement=SyslogMessage),
  (DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("mysql", "mysql.exe", "mariadb", "mariadb.exe")
    | where ProcessCommandLine has "general_log"
    | project TimeGenerated=Timestamp, Computer=DeviceName, Source=InitiatingProcessFileName, Statement=ProcessCommandLine)
| where Statement matches regex @"(?i)set[ ]+global[ ]+general_log"
| extend WebshellPath = Statement matches regex @"(?i)general_log_file.*[.](jsp|jspx|php|aspx?)"
| extend KnownArtexName = Statement matches regex @"(?i)(cl1217|f1219a|z1219)[.]jsp"
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Statements=make_set(Statement, 5) by Computer, WebshellPath, KnownArtexName
| order by WebshellPath desc, LastSeen desc
```

### Sigma

```yaml
title: MySQL General Log Redirected to Web-Served Script File (ARTEX JSP Webshell Technique)
id: 7b1f0c2e-5a41-4d8e-9c3a-2e6f1a9d4b10
status: experimental
description: Detects a MySQL/MariaDB client command line that enables the general query log and repoints general_log_file, the technique GTIG attributed to ARTEX for writing JSP webshells into web-served directories (TL-2026-5758).
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks
  - https://intel.threadlinqs.com
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial-access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/mysql'
      - '/mariadb'
  selection_cli:
    CommandLine|contains|all:
      - 'set global'
      - 'general_log'
  condition: all of selection_*
falsepositives:
  - DBA temporarily enabling the general log for troubleshooting (the log path will not be a web script extension)
level: high
```

**Known false positives:**

- DBA enabling the general log for troubleshooting, typically to a .log path outside web roots
- Database migration or audit tooling that toggles general_log

**Tuning notes:** Treat webshell_path=yes or known_artex_name=yes as high-fidelity. Exclude documented DBA change windows and service accounts. Adjust index/sourcetype to wherever the MySQL general log is ingested; if it is not logged, rely on the command-line (KQL/Sigma) forms.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Inbound Access to Exposed AI Offensive-Framework Consoles (PentAGI, Agent Zero, ScopeWeaver, Pojun, Xalgorix) (locked: unlock with TL Creds)
- ARTEX Persistence: Accounts Created or Modified with ArtexProbe Marker (locked: unlock with TL Creds)
- ARTEX Cloud Permission Probing: AWS DryRun and Azure deployments/validate Bursts (locked: unlock with TL Creds)
- Secret-Scanner and Offensive-Framework Execution on Servers (gitleaks, trufflehog, secret_scan, HexStrike) (locked: unlock with TL Creds)
- JSP Webshell Written by Database Process or Matching ARTEX Filenames (locked: unlock with TL Creds)
- WinRM Remote Execution: wsmprovhost.exe Spawning Shells and Recon Utilities (locked: unlock with TL Creds)
- ARTEX Active Directory Credential Access: DCSync and Kerberoasting (locked: unlock with TL Creds)
- ARTEX C2 and Exfiltration Egress: [indicator], [indicator] and Community Sibling Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- IP address: `38.244.50[.]120`
- Domain: `xcai[.]pro`
- Domain: `webhook[.]site`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Researchers Uncover 45 AI Hacking Frameworks, With Hundreds of Attack Consoles Exposed on the Internet](https://gbhackers.com/45-ai-hacking-frameworks/)
- [GitGuardian: AI pentesting tools beyond ARTEX](https://blog.gitguardian.com/ai-pentesting-tools-beyond-artex/)
- [GTIG: ARTEX and Friends Enter Agentic Offensive Frameworks](https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks)
- [CrowdStrike: Unknown Threat Actor Uses ARTEX to Target South Korean Finance](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/)
- [Check Point ARTEX research summary: 1,608 live servers, 400,791 agent messages](https://explainx.ai/blog/check-point-hacking-on-autopilot-artex-1608-live-servers-operator-logs-400791-agent-messages-2026)
- [GBHackers: ARTEX AI agents](https://gbhackers.com/artex-ai-agents/amp/)
- [Censys finds 1,465 exposed hosts running ARTEX AI pentesting framework](https://letsdatascience.com/news/censys-finds-1465-exposed-hosts-running-artex-ai-pentesting-58bf3ec9)
- [BleepingComputer: Chinese hackers use ARTEX AI in automated attacks against 200 orgs](https://bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs)
- [eSecurityPlanet: ARTEX Cyberattacks: AI Agents Steal Credentials and Signing Certificates](https://www.esecurityplanet.com/threats/news-artex-ai-agents-credential-theft/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5758