Threat video1:00

ARTEX Family Consoles on Shodan: Detection & IOCs

Name: ARTEX Family Consoles on Shodan: Detection & IOCs
Uploaded: 2026-11-11T12:05:02+00:00
Duration: 1 min
Description: ARTEX agents let an LLM drive intrusions from exposed consoles. Covers 9 detection rules, 19 IOCs and 19 ATT&CK techniques, one a free Splunk SPL rule.

ARTEX agents let an LLM drive intrusions from exposed consoles. Covers 9 detection rules, 19 IOCs and 19 ATT&CK techniques, one a free Splunk SPL rule.

Read the full threat intel for ARTEX Family Consoles on Shodan: Detection & IOCs →

Chapters

0:00The hookAbout 45 AI hacking frameworks, now mapped.
0:04The storyPulled platform forks stay public.
0:12Attack pathAgents reportedly find exposed targets at scale.
0:26AttributionAttributed to Storm-0940.
0:32Indicators of compromise5 indicators to hunt: 1 IP, 1 domain and 3 file names.
0:38MITRE ATT&CK techniques19 ATT&CK techniques, from reconnaissance to exfiltration.
0:42Remediation4 steps now: Inventory internet-facing agent consoles and MCP servers on their default.
0:50Detection rules9 detection rules, in SPL, KQL and Sigma.

Transcript

0:00About 45 AI hacking frameworks, now mapped.

0:05Pulled platform forks stay public.

0:07Shodan counted 1,428 exposed consoles.

0:13Agents reportedly find exposed targets at scale.

0:16Weak web controls open a door.

0:18They probe cloud access, seeking credentials.

0:21Command and control hides in web services.

0:27Attributed to Storm-0940. Confidence: low.

0:325 indicators to hunt: 1 IP, 1 domain and 3 file names.

0:3819 ATT&CK techniques, from reconnaissance to exfiltration.

0:434 steps now: Inventory internet-facing agent consoles and MCP servers on their default.

0:519 detection rules, in SPL, KQL and Sigma.

0:56Threadlinqs. The unified security engineering platform.