Hundreds of copies of Artex hacker tool are out in the open

Security researchers found hundreds of copies of the Chinese-made artificial intelligence-supported hacker tool Artex open to the internet. Anyone can access these systems. Therefore, an outsider can launch a cyber attack on unsuspecting targets.

The tool is an open source and autonomous penetration testing software. In other words, it checks for weak points in computer systems on its own. It has also been linked to several cyberattacks since its public release in July.

More than 800 Installations Accessed Without Password

Cybersecurity firm Censys, which scans open or vulnerable systems on the internet, shared its findings in a blog post. According to the company, more than 800 separate installations can be accessed via the web without a login password.

Censys chief security researcher Silas Cutler, who wrote the article, says that not every copy was run with malicious intent. Many of them are used by authorized testers. However, since the software does not require being open to the internet, it is not clear why so many copies are open.

Moreover, these systems not only reveal the vehicle itself, but also reveal attack tools. For example, implants, that is, hidden malware, that secretly settle into the victim's network and provide permanent access can also be seen. Therefore, every exposed installation gives clues to the attackers' methods.

How Was It Used in Attacks?

Security companies have linked this tool to many large-scale attacks. One of these is the attack on the Korean financial sector in September. CrowdStrike attributed these attacks to a Chinese-speaking hacker using the tool. The hacker had left an "open directory" hosting the system.

According to Censys' data, the copy in question had been publicly available for months. Inside was attack data that stretched far beyond South Korean banks. On the other hand, payment and game companies are also included in this data.

The tool was also used in the attack against IT support giant ConnectWise in early October. China-linked hackers were able to monitor thousands of organizations whose data was kept in Microsoft's cloud. According to Microsoft, attackers broke into customers' cloud environments and stole data very quickly. Therefore, defenders were left with little time to detect and intervene.

Most of the related attacks used simple exploits. Guessing weak or known passwords and lack of multi-step authentication are among these.

Closed Source Transition Plan

The developer team announced that it will switch to a closed source model. Thus, new versions will be limited to paying customers only. Still, dozens of copies of the code remain on code-sharing sites and may continue to be used in active attacks.