Check Point Reads ARTEX Operator Logs: Agents Ran Hacks Nearly Unattended

Check Point Research has published the view from behind the operator’s console. Its 5 November 2026 report, “Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns”, draws on the databases of 10 ARTEX instances that were misconfigured to expose them to the internet. Check Point says earlier threat reports on ARTEX focused on telemetry from the victim side. Operator-side material has surfaced before: CrowdStrike analysed open directories holding an actor’s Claude Code session histories and ARTEX configuration files (see our coverage of TAG-217). What is new here is the prompt logs and task histories from the ARTEX consoles themselves.

Everything below comes from Check Point’s report unless we say otherwise. We have not seen the underlying databases, and we cannot independently verify the token counts, cost estimates or campaign results.

What ARTEX Is

Check Point describes ARTEX as a Chinese open-source, AI-powered penetration testing platform meant for security teams testing systems they own or are authorised to test. It uses large language models to coordinate multiple agents that plan tests, run security tools and record evidence. A web dashboard tracks assets, progress, captured traffic and findings.

According to Check Point, the original project was deleted on 8 September, and its developer made it closed-source on 8 October. Forks and backups keep it available to threat actors. The report gives both dates; we have not reconciled them against the repository.

How Many Instances

Check Point found 2,557 systems hosting or having hosted ARTEX panels, 1,608 of them live and public when it looked. The report’s key points say “more than 1,800 publicly exposed instances” and its conclusion says “more than a thousand publicly available servers”, neither of which matches the 1,608 in the body. We use the body number and flag the gap.

Of the live servers, Check Point places the largest share in the US (882, 54%), then Hong Kong (295, 18%) and China (103, 6%). It says new command-and-control servers spiked in mid-October, coinciding with prominent public reporting about the project.

It also groups servers into three clusters it believes with high confidence are run by the same operators, based on ARTEX’s version tag, shared autonomous system numbers and co-hosted services. The report cautions that a shared tag alone is a clustering hint, since it may only mean the same commit or Docker base image.

What the Operators Did

In the 10 analysed instances, Check Point says operators set a goal and then mostly checked progress. These are only the few misconfigured instances Check Point could read, out of the 2,557 systems it found, so we would not assume the pattern holds for every operator. The sample prompts it quotes, which are Check Point’s English translations of Chinese prompts and all come from the iOS campaign below, are short questions such as “What is the current progress?” and “Which one is closest?“. Check Point says all goals in the analysed instances were opportunistic and financially motivated. Agents used weak or hardcoded passwords, remote code execution and business logic flaws, among other weaknesses. Many operators routed agents through residential proxies to get around WAF restrictions and IP blocks.

On models, Check Point reports Chinese models dominated, led by the DeepSeek Flash family, and that these showed no signs of guardrails under ARTEX’s penetration-testing framing. It says American models were configured on 3 instances and that guardrails triggered only with Anthropic’s Opus 5.5, after which the actor moved to a more permissive Chinese model.

Three Campaigns

iOS certificate theft. One operator ran two consoles in parallel from 14 to 29 October 2026 against 10 grey-market iOS signing shops, with the goal “get a p12 certificate + password”. Check Point reports 36 billion tokens and a DeepSeek API cost of roughly $700 to $1,500. Agents entered through hardcoded administrator passwords in JavaScript bundles and two kinds of remote code execution (command injection and server-side template injection), among other routes, and in one case escalated privileges on a Linux host through permissive folder access. They recovered more than 300 certificates with passwords and ran a validation pipeline. Three passed all checks and could sign arbitrary iOS apps.

Failed crypto draining. A second operator spent 4 days and 167.5 million tokens, which Check Point estimates at $145 to $300. The first round tasked agents with 292 crypto payment domains, asking them to withdraw USDT and swap in the attacker’s receiving address. Check Point says the objective was not achieved. In a second round some agents claimed successful cashouts, but the attacker wallet held $0 with no transactions, and Check Point calls those findings hallucinations based on API responses that merely said “success”. In a third attempt, aimed at a TRON wallet holding about $600,000, agents did not identify the holder but found an unauthenticated API leaking AWS S3 credentials with write access to a bucket serving iOS apps and landing pages. Check Point says the agent carried out the write and verified the chain before filing a finding, but the bucket owners later restored the original manifest file. Check Point’s conclusion is that “the write was successful, but the compromise was not properly exercised”; the operator’s own wallet shows a zero balance and no transactions.

Game credential harvesting. A third operator, whose prompting Check Point lists as none beyond the initial goals, pointed agents at 13 credential back-ends for a grey market in hacked game accounts. Over about five days, at an estimated $180 to $360, agents found that some shops kept credentials in a static file in the web root, including one holding 21.5 MB of plaintext credentials. They recovered more than 190,000 credential sets for a single game. The 3.3% valid rate and the roughly 6,000 live accounts come from the agent’s own summary, which Check Point quotes; the report does not say Check Point re-tested them.

What This Means

Our assessment: the hard numbers in the report are cost and effort, and they cut both ways. A $700 to $1,500 run that produced three usable certificates is low-cost for the operator, though Check Point gives no resale value for the certificates. A crypto operation aimed at a wallet holding about $600,000 moved nothing, and Check Point says agents’ reports of cashout success were based on API responses alone. That is our reading: agent-reported success needs independent checks, and the near-unattended operation in our headline describes only the instances Check Point could read.

Our assessment is that the exposure Check Point describes is mundane: hardcoded credentials in front-end bundles, plaintext files in web roots, and unauthenticated APIs leaking cloud keys. Check Point’s own advice is to test and harden the exposed perimeter, since a target of an agentic campaign should expect a high volume of attempts. Our own suggestion, not Check Point’s: start by searching their public JavaScript and web roots for secrets, and by checking storage credentials for write scope that public services do not need.

For other ARTEX reporting, see Storm-0940 and Kernel, where Kernel says it believes ARTEX was used but that link is unconfirmed.

References

• Check Point Research — Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns
• CrowdStrike — Unknown Threat Actor Uses ARTEX to Target South Korean Finance