ARTEX is an open-source, LLM-driven autonomous penetration-testing framework, and its web console is now deployed at scale on U.S. commercial hosting. Starting from internet-wide scanner telemetry, SOCRadar researchers merged and de-duplicated 1,295 U.S.-hosted candidate instances, re-validated each one, and confirmed 916 live ARTEX-family consoles in a snapshot taken on November 11, 2026.
The software was built to help security teams test systems they own. The same framework, exposed the same way, has also turned up in documented intrusions, and a trojanized build circulating on Docker Hub gives anyone who knows a secret marker a pre-authentication root shell on the console host. With the United States the single largest host of ARTEX worldwide, the population is both an offensive-AI capability operating from U.S. infrastructure and a large, trackable attack surface in its own right.
This post covers how big the U.S. footprint is, how its forks and rebrands differ, which operator fleets dominate it, how the backdoored builds affect it, and the indicators defenders can use to hunt it.
Key Takeaways
- Population: 1,295 unique U.S. candidate IPs from three scanner feeds; 916 confirmed live ARTEX-family consoles (71%), supporting the circulating “~1,000 machines” figure with 916 as the confirmed floor
- Cleartext exposure: 896 of the 916 consoles are served over plain HTTP
- Concentration: 512 live consoles (56%) sit in only 19 contiguous /24 blocks, mostly on AS54600 (PEG TECH), a pattern more consistent with templated deployment than independent adoption
- Operator fleets: one self-signed certificate is reused across 202 hosts in nine /24 blocks, and 231 U.S. ARTEX hosts also run a Sub2API AI API gateway on a second port
- Backdoored builds: public reporting observed 62 consoles serving a trojanized build, 26 of them in the U.S., with an unauthenticated root shell hidden in the login handler
ARTEX at a Glance
| Attribute | Detail |
|---|---|
| Software | ARTEX, a Chinese open-source, AI-powered autonomous penetration-testing platform |
| Stack | Go backend, embedded Next.js console, PostgreSQL store |
| Default port | 8787 (also 8790) |
| Console title | <brand> – 自主渗透测试控制台 (“autonomous penetration-testing console”) |
| U.S. candidates | 1,295 unique IPs (passive, de-duplicated) |
| Confirmed live in the US | 916 ARTEX-family consoles |
| Served over plain HTTP | 896 |
| Initialized (configured) | 451 report initialized: true |
| Main hosting | AS54600 (PEG TECH / Cogent) |
| Supply-chain risk | Trojanized Docker images tomicdd/artex and congdonglinux/artex |
| Snapshot date | November 11, 2026 |
What Is ARTEX?
ARTEX uses large language models to coordinate multiple AI agents that plan tests, run security tools and record evidence of potential vulnerabilities. Its web dashboard brings together assets, testing progress, captured traffic and findings, so an operator can monitor activity and steer the agents. Each investigation is tied to specific assets, and the platform supports vulnerability re-testing.
Because the code is public and freely forkable, SOCRadar treats ARTEX as a software family (the original, its forks and its rebrands) rather than as a single threat actor. Not every instance is malicious, and some belong to authorized testers.
A console captured in separate research shows 1.2 million LLM tokens consumed on a task, 28 asset nodes and an activity feed with an automated WebFetch against a malware repository, a sign that such deployments are in active use.
How the U.S. Footprint Was Measured
The investigation used two layers, reported separately so discovery and confirmation are never conflated:
| Layer | Meaning | Result |
|---|---|---|
| Passive | Hosts first observed by three internet-wide scanners, merged and de-duplicated on unique IP | 1,295 unique U.S. IPs |
| Active | A single redirect-following GET / probe per host, collecting favicon, TLS, JARM and build fingerprint | 916 live ARTEX consoles |
De-duplicating on unique IP matters: one scanner returned 851 records for only 659 unique hosts. Per-source coverage was 1,008, 854 and 659 unique U.S. IPs. Of the 1,295 candidates, 240 no longer responded and 139 responded as something other than an ARTEX console. Hosts seen by all three scanners were almost all still live, while single-source candidates were more often offline. Around 50 of the candidates answered only with a “plain HTTP sent to HTTPS port” error; some are likely ARTEX over HTTPS, but they were held out of the 916 figure to keep it conservative.
The active layer was limited to landing-page fingerprinting. No authentication, credential testing, endpoint enumeration or exploitation was performed.
For external corroboration, separate analysis counted 1,465 ARTEX hosts worldwide (about 815 distinct deployments) on November 3 to 4, 2026, with the United States the top country at 726 hosts.
Variants, Forks and Rebrands
Every ARTEX-family console carries the title pattern <brand> – 自主渗透测试控制台. The brand token is operator-editable, which is what makes variants separable. SOCRadar grouped live consoles into four tiers:
- Tier A, original ARTEX: genuine ARTEX builds
- Tier B, fork or translation: for example the English “Autonomous Pentest Agent” fork
- Tier C, operator rebrand: the same software under a new name, such as AntiFox, BoomInner or SHRIKE
- Tier D, unbranded: no brand token
| Brand Token | Live Hosts | Tier |
|---|---|---|
| ARTEX | 874 | A |
| AntiFox | 17 | C |
| BoomInner | 6 | C |
| 渗透工作台 | 4 | C |
| Autonomous Pentest Agent | 2 | B |
| (none) | 2 | D |
| TGSEC 社区专属版 | 2 | C |
| artex | 2 | A |
| LMTex | 1 | C |
| 月落 | 1 | C |
| artex-mx | 1 | C |
| GOPHER-ARTEX 1.0 | 1 | C |
| lxcloud | 1 | C |
| SHRIKE | 1 | C |
The rebrands appear to be separate operators running the same engine, and they are useful leads for follow-on hunting. One Tier C console carries a custom operator signature in its login greeting, and further names such as “Ayven” have been seen live on test[.]tigerpark[.]top. Brand tokens mutate quickly, but the login flow, asset structure and favicon stay constant, so title-suffix and favicon pivots remain reliable as names change.
Build Fingerprints and Version Drift
The console is a Next.js static export, so its JavaScript chunk filenames are content-hashed. Hashing the sorted chunk set produces a build fingerprint. One build, d284c4c4797bf94e, runs on 661 hosts, consistent with a single shared image propagated across the fleet.
| Reported Version | Live Hosts (Scanner-Observed) |
|---|---|
| sco-fix2 | 246 |
| dev | 131 |
| 0.3.15 | 11 |
| 0.3.16 | 7 |
| 0.3.25 | 5 |
| 0.3.14 | 5 |
| 0.3.24 | 4 |
| f3e3f54 | 4 |
| 0.3.13 | 3 |
| v0.3.15-local | 3 |
The two most common version strings, sco-fix2 and dev, are not semantic releases. They point to a non-official, actively patched build line shared across the large PEG TECH clusters rather than clean upstream installs.
The favicon hash cited in earlier public write-ups (mmh3 -1898746557) now appears on only about 21 live hosts. The current build ships a different favicon (-576220750) seen on 817 hosts, so hunting on the older hash alone would miss most of the population.
Hosting and Operator Clusters
The live population is heavily concentrated: 472 hosts sit in just 11 /24 blocks and 512 in 19 blocks, largely on AS54600 (PEG TECH / Cogent). Sequential IP assignment inside these blocks, combined with identical build fingerprints, is more consistent with templated rollout than with independent users.
Clustering relied only on strong, operator-controlled artifacts (shared X.509 certificates, shared SSH host keys and shared ETags), never on ASN alone. Three large fleets stand out, each assessed with high confidence as a single-operator or shared-image cluster:
| Cluster | Networks | Hosts | Hosting | Binding Artifact |
|---|---|---|---|---|
| C1. PEG TECH mega-cluster | 38.11.173.0/24, 38.11.221.0/24 | 242 | AS54600 PEG TECH | Shared build d284c4c4, identical ETag pair, sequential IPs |
| C2. Certificate-bound PEG | 38.11.56/63, 38.12.72/90, 38.38.166/174/175/190, 107.149.90.0/24 | 202 | AS54600 PEG TECH | One self-signed certificate across nine blocks |
| C3. RedLuff / Yancy | 103.48.132.0/24, 23.248.203.0/24 | 34 | AS138415 RedLuff / Yancy | One certificate across both blocks |
Certificate reuse across 202 hosts in nine blocks points to a single operator or a shared golden image. For C3, separate research lists 157 ARTEX hosts on AS138415, a network that also saw a December 2025 Cobalt Strike surge, though the link between the two remains unclear.
Sub2API: The Gateway Bundled With the Fleet
231 U.S. ARTEX hosts also serve a “Sub2API – AI API Gateway” console on a second port, overwhelmingly inside the two PEG TECH super-blocks (111 hosts in 38.11.221.0/24 and 102 in 38.11.173.0/24). Running an ARTEX console alongside an API and key-proxying gateway across most of the two PEG TECH super-blocks is consistent with a single provisioning template. Sub2API also gives defenders a secondary pivot that can surface the same operator even where the ARTEX console is moved behind TLS or to a non-standard port.
ARTEX in Real Intrusions
Several hosts connect the ARTEX population to documented attacks and to operators who left their own tooling exposed, with the open-directory, ARTEX MX and full Storm-0940 IP findings drawn from separate research:
| Host | Scope | Significance |
|---|---|---|
| 38.244.50.120 | U.S., offline | ARTEX host behind a South Korean finance sector intrusion; an open directory on port 18899 exposed a Claude Code CLAUDE.md file, while session histories and ARTEX configs sat on a separate Hong Kong-based host; the instance used DeepSeek as its LLM backend, likely accessed through a reseller |
| 144.172.64.60, .99, .128 | Non-U.S. | Storm-0940 infrastructure in the ConnectWise Cloud Backup supply-chain campaign, where ARTEX was used to speed up scanning, reconnaissance, password spraying and OAuth application abuse |
| 154.12.86.207:18080 | Non-U.S., offline | Open directory exposing an operator home directory, with SSH and shell-history files next to the ARTEX install |
| 181.41.194.136:8081 | Non-U.S., offline | Open directory holding about 18 HTA droppers, batch loaders, a wpad.dat file and a MITM root CA private key |
| 104.250.149.210 to .213 | U.S., offline | Four adjacent hosts running the “ARTEX MX” rebrand on sequential IPs |
One Host, Several Attack Tools
Some U.S. hosts run ARTEX side by side with other agentic attack tools and self-hosted LLM proxies, leaving a complete offensive-AI toolkit reachable from the internet:
| Host | Hosting | Services (Port: Tool) |
|---|---|---|
| 192.253.229.113 | CTG Server Ltd, Los Angeles | 8787: ARTEX, 8080: CyberStrikeAI, 8790: 麸鸟渗透智能体 Agent Workbench |
| 192.238.245.116 | SpeedVM Network (AS138995), Los Angeles | 8787: ARTEX, 8080: Sub2API, 80: New API (LLM proxy) |
| 192.236.166.73 | RackNerd / HostPapa | 8787: ARTEX, 8080: CyberStrikeAI, 443: LunaFox ASM |
In total, 12 U.S. ARTEX hosts pair the console with a distinct attack or LLM-proxy tool such as CyberStrikeAI, LunaFox, ScopeSentry, New API or agent-workbench rebrands, separate from the broader Sub2API bundling.
Backdoored ARTEX Builds
After the original Autumn-27/ARTEX repository was taken down, copies, translations and rebrands kept circulating, and at least one distribution channel was trojanized. A researcher, Badbyte, found a hidden verifyCaptcha() function added to the ARTEX login handler. If the CAPTCHA field begins with a secret marker, the rest of the input is executed via sh -c as root before any credential check, giving an unauthenticated root shell on any host running the build. The change was described as not visible in a normal code review.
| Vector | Indicator | Note |
|---|---|---|
| Docker Hub | tomicdd/artex | Backdoored; thousands of pulls; removed by Docker |
| Docker Hub | congdonglinux/artex | Backdoored, identical to the above; removed |
| GitHub | github.com/trhhubsd/ARTEX(X) | 2,449 stars and 600+ forks; docker-compose.yml changed to pull the backdoored image; now down |
| GitHub (other copies) | mhtsec/ARTEX, RuoJi6/ARTEX | Additional mirrors of the project |
| Other Docker Hub namespaces | autumn26, andy1099zz, dgddw, ylh440104, mianhuatang11 | Publishing ARTEX images; trust unverified |
Public reporting covering November 2 to 4, 2026, counted 62 consoles serving the backdoored build (26 in the U.S., 17 in Hong Kong and 7 in China) out of 1,645 ARTEX hosts worldwide, a separate count from the 1,465 cited above. After the takedown, 637 GitHub repositories still pointed at the backdoored image.
This matters directly to the U.S. population. Most consoles that report a version run non-official dev or sco-fix2 builds, exactly the kind of copy that pulls images from untrusted registries. An internet-exposed, cleartext console that is also backdoored is reachable and root-executable by anyone who knows the marker, which makes the console’s own operator the victim.
The project is also widely mirrored. A conservative GitHub search for (ARTEX AND autonomous) OR 自主渗透测试控制台 returns 232 repositories, and the true count is higher because rebrands such as AntiFox, ScopeWeaver and Ayven drop the ARTEX name entirely.
Risk Assessment for U.S. Defenders
The risk is twofold: the consoles are an offensive-AI capability operating from U.S. infrastructure, and each exposed console is itself an attack surface. Running ARTEX on U.S. commercial providers places AI-driven reconnaissance and exploitation close to U.S. targets, inside networks many defenders implicitly trust, with clean, low-friction egress.
| Group | What Is at Risk | Rating |
|---|---|---|
| Intrusion and OpSec-failure hosts | Third-party victims, plus operators’ leaked tooling, prompts and credentials | High |
| Tool-stacking hosts | A full offensive-AI toolkit (pentest agent, attack tool, LLM proxy) reachable from the internet | High |
| Large fleets | Hundreds of U.S.-hosted consoles under shared control, most over plain HTTP | Medium to High |
| Backdoored builds | The operator’s own host, through unauthenticated root execution (26 U.S. hosts observed) | Critical |
Other exposure factors:
- Cleartext sessions: with 896 consoles on plain HTTP, anyone on-path sees the operator’s session
- Configured consoles: 451 hosts with module telemetry report initialized: true, meaning set-up consoles rather than untouched defaults
- Open directories: frequent exposed directories put operators’ tooling, prompts and credentials at risk
Hunting Pivots and Recommendations
Durable Pivots
| Pivot | Value or Query | Note |
|---|---|---|
| Console title | 自主渗透测试控制台 | Most durable; survives rebrands as the title suffix |
| Favicon (current) | mmh3 -576220750 | Current build; the older -1898746557 is now rare |
| Default port | 8787 and 8790 | 804 live hosts on 8787; 231 on 8790 |
| Build fingerprint | Sorted /_next/static/* chunk set | Groups shared images; 661 hosts on one build |
| Scanner module | artex.initialized, artex.version | Confirms the app and its build line |
| Shared certificate or SSH key | X.509 SHA-256, SSH host key SHA-256 | Strong ownership signal for operator clustering |
Recommendations
- Watch the perimeter: alert on the port, favicon and title indicators above crossing your network boundary
- Investigate listed blocks: treat traffic to or from the networks in the IOC section as worth investigating
- Treat exposed consoles as attack surface: handle any ARTEX console reachable from your network as a potential threat until its owner and purpose are confirmed
- Check your own ARTEX deployments: if your team runs ARTEX, compare the image source against the backdoored names above
- Assume compromise on bad images: treat any instance built from tomicdd/artex or congdonglinux/artex as compromised; rotate credentials, LLM API keys and sessions, and rebuild from source
- Do not expose the console: keep any authorized ARTEX deployment off the public internet and behind TLS and authentication
Indicators of Compromise (IOCs)
For the full list of indicators of compromise from this research, see our GitHub repository.
TLS values are X.509 leaf SHA-256; SSH values are host-key SHA-256 fingerprints.
| Type | Indicator | Scope |
|---|---|---|
| Network | 38.11.173.0/24, 38.11.221.0/24 | 242 live consoles (PEG TECH mega-fleet) |
| Network | 38.11.56.0/24, 38.11.63.0/24, 38.12.72.0/24, 38.12.90.0/24, 38.38.166.0/24, 38.38.174.0/24, 38.38.175.0/24, 38.38.190.0/24, 107.149.90.0/24 | Certificate-bound PEG cluster (202) |
| Network | 103.48.132.0/24, 23.248.203.0/24 | RedLuff / Yancy operator (34) |
| TLS cert SHA-256 | 90532571ef9178c9875ccc4e2048be90f5cfe47c90e6fe025516f7ec019ae48e | 202 hosts, 9 blocks (PEG) |
| TLS cert SHA-256 | b90f115d0335385bd9a361822e67b94a640897c9a25f8858744270cd32e61358 | 34 hosts, 2 blocks (RedLuff) |
| TLS cert SHA-256 | ddf1b548eea2eb9219396d870aa954e18c85610f9eadf780b0d59e6b6bbeb76f | 5 hosts (38.45.125.0/24) |
| SSH host key SHA-256 | 6F3wOYl1/NK7HABoJez3GYgXI6lMCVyNYbaKNKE4fXw (rsa), Ds8VdxuwhRFVJ6HDfKi5Ut/4zuRICqOeEIfCC+K+LQg (ecdsa), VdLLLYPPRKJIoaPTAyz3ANcLjrMu/5ajHY/v9lZLtkU (ed25519) | QuickMeg fleet (173.0.3.0/24) |
| SSH host key SHA-256 | htApzYmrfaxD8g7ROL3+YXSjNTO+R8OSI2Up38lAfkk (rsa) | 154.9.244.0/24 fleet |
| Favicon (mmh3) | -576220750 | 817 live consoles (current build) |
| Favicon (mmh3) | -1898746557 | Legacy, less common build (~21) |
| Backdoored image | tomicdd/artex, congdonglinux/artex | Trojanized Docker builds |
All counts reflect a single snapshot taken on November 11, 2026. The population churns, so figures should be read as a point-in-time floor rather than a fixed total.
Frequently Asked Questions
What Is ARTEX?
ARTEX is a Chinese open-source, AI-powered autonomous penetration-testing platform. It uses large language models to coordinate AI agents that plan tests, run security tools and record evidence of vulnerabilities, all managed from a web console that listens on port 8787 by default.
How Many ARTEX Consoles Are Exposed in the United States?
SOCRadar confirmed 916 live ARTEX-family consoles on U.S. hosting in a November 11, 2026 snapshot, out of 1,295 de-duplicated candidates. That makes the circulating “~1,000 machines” figure a reasonable central estimate, with 916 as the confirmed lower bound.
Is ARTEX Malware?
No. ARTEX is a penetration-testing tool intended for authorized security testing, and some exposed instances belong to legitimate testers. The same software has, however, been tied to a South Korean finance sector intrusion and to the Storm-0940 ConnectWise Cloud Backup supply-chain campaign, and from the outside a sanctioned test cannot be told apart from a live intrusion.
Who Is Running the U.S. ARTEX Fleet?
The investigation did not attribute the fleet to a named actor. It did find that 512 of the 916 live consoles sit in 19 /24 blocks, mostly on AS54600 (PEG TECH), and three clusters bound by shared builds, certificates and ETags are assessed with high confidence as single-operator or shared-image deployments.
What Is the ARTEX Docker Backdoor?
Trojanized ARTEX images on Docker Hub (tomicdd/artex and congdonglinux/artex) contain a hidden verifyCaptcha() function in the login handler. Input starting with a secret marker in the CAPTCHA field is executed as root via sh -c before any credential check, giving an unauthenticated root shell on the console host.
Is Removing the Backdoored Image Enough?
No. Any instance built from the backdoored images should be treated as compromised: rotate credentials, LLM API keys and sessions, and rebuild from source. Because 637 GitHub repositories still pointed at the backdoored image after the takedown, check the image source of every new deployment as well.
How Can I Detect ARTEX Consoles on My Network?
Use the console title suffix 自主渗透测试控制台, the current favicon hash mmh3 -576220750, and ports 8787 and 8790 as primary pivots. Shared TLS certificates, SSH host keys and the network blocks listed in the IOC section help tie hosts to specific operator fleets.
Source: SOCRadar · 2026-11-12