AI Lowers the Barrier to Cyberattacks: Our Tracking of ARTEX Infrastructure

[Related articles]

• ARTEX v2: AI Penetration Testing and Infrastructure Analysis
• Tracking ARTEX Infrastructure: Signs of Real-World Cyberattacks

What is ARTEX?

ARTEX is an open-source autonomous penetration testing framework based on LLMs and released by GitHub user Autumn-27. It is designed to divide responsibilities among AI agents as they plan and perform penetration testing tasks, including asset discovery, vulnerability identification, and validation. Users can also intervene during execution when needed.

ARTEX is not inherently malicious. As a publicly available open-source project, it can also be used for legitimate security research and penetration testing. Combined with existing security tools and attack techniques, LLM-powered agents can automate several stages of a penetration test.

ASEC identifies approximately 600 ARTEX-related IP addresses

ASEC tracked related internet-facing infrastructure based on ARTEX's characteristics.

Starting with IP addresses that hosted ARTEX instances, ASEC analyzed the associated infrastructure and identified approximately 600 additional IP addresses.

However, not all of these IP addresses should be classified as attack infrastructure. Because ARTEX is publicly available, the findings can include legitimate security research and testing environments.

An individual IP address, therefore, does not establish malicious activity. Analysts must also examine the services running at that address, links to related infrastructure, and any evidence of malicious activity.

ARTEX and CyberStrikeAI Found on the Same IP Addresses

ASEC also found multiple IP addresses exposing services associated with both ARTEX and CyberStrikeAI.

CyberStrikeAI is also an open-source, AI-powered offensive security platform. Its capabilities include asset discovery, security tool and workflow automation, attack chain analysis, WebShell management, and C2 management.

ASEC also found indications that both projects were circulating in Chinese-speaking security communities.

However, finding both platforms on the same IP address does not establish that a specific attack group or a single threat actor operates them.

What matters is that different AI-powered offensive security platforms have been observed running together on internet-facing infrastructure.

How AI-Powered Penetration Testing Could Lower the Barrier to Cyberattacks

The ARTEX case deserves attention for what it suggests about AI's expanding role in cyberattacks, not just for the capabilities of the tool itself.

LLMs can now support attack planning, tool selection and execution, results analysis, task-state management, and information sharing between agents. However, AI cannot yet fully replace a skilled attacker's judgment. But by assisting with specialized tasks and repetitive work, it could reduce the expertise needed for some attack stages.

For less-experienced attackers, this could lower the barrier to entry. For skilled attackers, automation could increase the speed and scale of their attacks.

The broader shift matters more than ARTEX itself. AI is lowering the technical barrier to entry for cyberattacks.

Analyzing ARTEX Infrastructure and Related Cyber Threats

Because ARTEX can be used for legitimate testing as well as attacks, its presence on a system is not evidence of malicious activity on its own. Threat monitoring therefore needs to establish where a tool is running, which infrastructure and other tools are associated with it, and whether there is evidence of malicious activity.

As AI-driven automation expands, attackers can combine existing tools and techniques more quickly. Threat intelligence should therefore connect individual indicators of compromise (IOCs) with the infrastructure, activity, and tools associated with them.

Phishing and Smishing Risks After Personal Data Breaches

Phishing and smishing attacks can follow after breaches that expose personal or account information. Attackers can use information such as names, phone numbers, and email addresses to impersonate legitimate institutions or companies. Messages urging users to “check whether your personal information was leaked,” “claim compensation,” or “protect your account” may lead them to fraudulent websites or trick them into installing malicious apps.

To reduce the risk of follow-on attacks, we advise users to avoid suspicious links, verify claims through official channels, change passwords for each account, and enable multifactor authentication (MFA).

ARTEX threat intelligence available through AhnLab TIP