Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns Check Point Research found 2,557 systems hosting or having hosted ARTEX panels, with 1,608 live and publicly available instances at the time of its research, as threat actors used the Chinese open-source AI-powered penetration testing platform to run autonomous cybercrime campaigns. Ten instances were misconfigured to expose the full ARTEX database, revealing how operators prompted their agents, which models were used and the exact attacks carried out; Chinese models, led by the Deepseek Flash family, dominated configured LLMs, and guardrails were hit only on Anthropic's Opus 5.5, after which the actor switched to more permissive Chinese models. ARTEX's developer made the project closed-source on October 8th after the tool was observed in attacks against South Korean banks, but maintained forks and backups keep it publicly available, alongside similar frameworks CyberStrike, Cairn and PentAGI. ARTEX is a Chinese open-source, AI-powered penetration testing platform designed to help security teams assess systems they own or are authorized to test. It uses large language models LLMs to coordinate multiple AI agents that plan tests, run security tools, and record evidence of potential vulnerabilities. Its web dashboard brings together assets, testing progress, captured traffic, and findings, allowing users to monitor activity and guide the agents. By linking each investigation to specific assets and supporting vulnerability retesting, ARTEX aims to reduce repetitive work while keeping human oversight central to the testing process. After the tool was observed in attacks against South Korean banks https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/ , its developer decided to make the project closed-source on October 8th. However, various maintained forks and backups of the original repository keep the tool publicly available to threat actors. As described further below, artifacts obtained by Check Point Research show that these systems can work fully autonomously after the initial goal has been set by the operator. Using agentic hacking frameworks like ARTEX, threat actors can carry out attacks at a previously impossible speed, on a broad scale and without any technical knowledge, opening the field to a large set of people. Besides ARTEX, other frameworks such as CyberStrike https://github.com/CyberStrikeus/cyberstrike , Cairn https://github.com/oritera/Cairn or PentAGI https://github.com/vxcontrol/pentagi offer similar capabilities. Check Point Research also observed various other custom agentic hacking frameworks in the wild. While some of these are based on open-source tools such as those mentioned above, others are written from the ground up. While many ARTEX instances are hidden behind firewalls or are set up in local networks, threat actors often expose administrative interfaces to the internet, to make them accessible remotely. Check Point Research found 2,557 systems hosting or having hosted ARTEX panels, with 1,608 live and publicly available instances at the time of the research. A metadata analysis of these servers gives valuable insights into the distribution and usage. Additionally, 10 instances were misconfigured to expose the full ARTEX database – giving a rare insight into how actors prompted their agents, which models were used and the exact steps and attacks the agents carried out. In the analyzed 10 instances, Chinese models dominate the share of configured LLMs, with models of the Deepseek Flash family being the most prevalent. With American models configured on 3 different instances, we observed guardrails being hit only when using Anthropic’s Opus 5.5. Here, the actor subsequently switched to more permissive Chinese models. The campaigns observed, targeted various industries, with goals ranging from acquiring cryptocurrency, and stealing code-signing certificates or gaming accounts from grey-market infrastructure to carrying out Denial-of-Service DoS attacks against gambling sites. Almost all of these campaigns can be classified as opportunistic cybercrime – operations with a broad scope instead of a single target. Three example campaigns are described below. The observed ARTEX instances were running in default configurations using default tools. To get around WAF restrictions, IP blocks and obscure traffic, many operators configured their agents to use residential proxies. One operator created a dedicated skill for proxy-usage. Apple’s iOS code-signing ecosystem has given rise to an underground market for .p12 code signing certificates and their associated provisioning profiles. Possession of such a certificate enables signing iOS apps and sideloading them, bypassing the official App Store. A 2026 study https://www.usenix.org/system/files/conference/usenixsecurity26/sec26 prepub liu-yijing.pdf found that these certificates are distributed in a network of gray-market certificate marketplaces and signing services, with a large share of them located in China. Use-cases range from modifying existing applications to bypass restrictions or add features to injecting libraries that exfiltrate sensitive data or introduce other malware. One ARTEX operator was observed tasking their agent fleet with compromising those gray-market signing shops themselves in order to steal their certificates and resell them . The operator ran two ARTEX consoles in parallel for roughly two weeks from 2026-10-14 to 2026-10-29 using the Deepseek v4.1 Flash and Kimi K3.1 Pro models. In total, the operator worked through 36 billion tokens , consisting of 2.13 billion input tokens cache miss , 33.79 billion input tokens cache hit , and 473.9 million output tokens. According to the official DeepSeek API prices at the time of writing, this amounts to a cost somewhere between $700 and $1500. The operator targeted a total of 10 different signing shops, with the goal of the task set to “get a p12 certificate + password”. Once an agent managed to break into a signing shop, the agents searched for the 证书库 cert library , a database full of .p12 files and their respective plaintext passwords. Once that database was obtained, agents ran a validation pipeline on each compromised key: .mobileprovision file which is needed to complete signing of an application To gain initial access to the signing shop’s infrastructure the agents used the following vulnerabilities: One case additionally involved privilege escalation on a Linux host from a low privileged user to root through overly permissive folder access. In total, the agents managed to get more than 300 certificates and their passwords. After the agents validated them, three certificates passed the checklist. These could thus be used to sign arbitrary iOS applications and be sold by the operator. The interaction of the threat actor with its agents was minimal: most messages are simply asking about the progress of the operations and whether specific certificates have already been obtained. As such, the agents were working almost entirely autonomously. Below is a summary of all user prompts, with victim info redacted: | Original Chinese | English translation | |---|---| | 你好 | “Hello” | | 你好 | “Hello” | | 你好 | “Hello” | | 哪个进度最接近 | “Which one is closest to the goal ?” | | 现在的进度是什么 | “What is the current progress?” | | 进度是什么 | “What’s the progress?” | | TARGET A 看看这本能不能搞到 哪个任务有 | “ TARGET A – check if this one can be gotten; which task has it?” | | TARGET B 在哪里 | “Where is the TARGET B profile ?” | | 你好 | “Hello” | | TARGET C 的进度是什么，glm的 | “What’s the progress on TARGET C – the GLM one?” | | 现在的哪个最接近网站，不包含完成了的 | “Which is closest to the target now, not counting the completed ones?” | | 现在的进度呢 | “And the progress now?” | | 进度是什么？ | “What’s the progress?” | | 现在的进度呢 | “And the progress now?” | | 1 | “1” bare selection / ack | | 进度是什么 | “What’s the progress?” | | TARGET D 我们有吗 | “Do we have TARGET D ?” Chinese iOS app-distribution platform | | 为什么不能参考我们 TARGET E 获取的方式 | “Why can’t we use the method we used to get it at TARGET E ?” | | 进度是什么 | “What’s the progress?” | | 已达成 TARGET F p12 目标什么意思 | “What does ‘ TARGET F p12 goal achieved’ mean?” | | 能否把全部的注入提示，focus on企业证书而非个人 | “Can you make all the injected prompts focus on enterprise certificates, not personal ones?” | | 进度是什么 | “What’s the progress?” | | 任务 5（ TARGET G ，运行 44.9h）