ARTEX Intel中文

Timeline

Check Point: misconfigured ARTEX instances expose cybercrime operations

Event date2026-10-14 to 2026-10-29
Disclosed2026-11-05
TypeCybercrime activity
ConfidenceSingle-source, unverified
ARTEX statusConfirmed use of ARTEX
Countries and regionsNot stated
SectorsGray market, Gaming, Crypto assets

Most attacks run fully autonomously once the target is set. Configurations mainly use Chinese models, with DeepSeek Flash the most common.

Confirmed victims

  • 10 gray-market iOS signing shops
  • 13 gaming credential backend servers

Targets

  • 292 crypto payment domains (failed, no transfers resulted)

Attribution

ARTEX basis
The evidence comes from 10 ARTEX instances that exposed full databases.
Actor
Cybercrime group (not named). Operators mainly watch progress.
Same attacker?
Not stated.

Figures and definitions

CertificatesOct 14 to 29: 36 billion tokens, 300+ certificates, 3 valid
Crypto4 days, 292 domains, 400,791 agent messages, 0 transfers
GamingAbout 5 days, more than 190,000 credentials, about 3.3% valid
Panels2,557 historical, 1,608 online (body text); Key Points says more than 1,800

Related IoCs

TypeValueRoleCheck
Network range198[.]200[.]59[.]85-89cluster tag sco-fix2, AS54600 PEG TECH INC, USASource report only
Network range38[.]11[.]173[.]1-125cluster tag sco-fix2, AS54600 PEG TECH INC, USASource report only
Network range38[.]11[.]221[.]1-125cluster tag sco-fix2, AS54600 PEG TECH INC, USASource report only
Fingerprintdev-db-resilience-20261031ARTEX cluster changing version tagSource report only
Fingerprintsco-fix2ARTEX cluster version tagSource report only
IP103[.]122[.]245[.]194changing tag e.g. dev-db-resilience-20261031, AS152918 Liberally Network LLC, ThailandPlatform: no verdict
IP103[.]122[.]245[.]198changing tag e.g. dev-db-resilience-20261031, AS152918 Liberally Network LLC, ThailandPlatform: no verdict
IP103[.]122[.]245[.]199changing tag e.g. dev-db-resilience-20261031, AS152918 Liberally Network LLC, ThailandPlatform: no verdict
IP103[.]122[.]245[.]204changing tag e.g. dev-db-resilience-20261031, AS152918 Liberally Network LLC, ThailandPlatform: no verdict
IP103[.]122[.]245[.]214changing tag e.g. dev-db-resilience-20261031, AS152918 Liberally Network LLC, ThailandPlatform: no verdict
IP103[.]122[.]245[.]215changing tag e.g. dev-db-resilience-20261031, AS152918 Liberally Network LLC, ThailandPlatform: no verdict
IP103[.]122[.]245[.]216changing tag e.g. dev-db-resilience-20261031, AS152918 Liberally Network LLC, ThailandPlatform: no verdict
IP103[.]122[.]245[.]217changing tag e.g. dev-db-resilience-20261031, AS152918 Liberally Network LLC, ThailandPlatform: no verdict
IP103[.]122[.]245[.]218changing tag e.g. dev-db-resilience-20261031, AS152918 Liberally Network LLC, ThailandPlatform: no verdict
IP103[.]122[.]245[.]219changing tag e.g. dev-db-resilience-20261031, AS152918 Liberally Network LLC, ThailandPlatform: no verdict
IP104[.]168[.]112[.]237ARTEX cluster (Check Point), AS36352 HostPapaPlatform: no verdict
IP192[.]236[.]172[.]197ARTEX cluster (Check Point), AS36352 HostPapaPlatform: no verdict
IP198[.]44[.]123[.]66ARTEX cluster (Check Point), AS36352 HostPapaPlatform: no verdict
IP204[.]44[.]66[.]81ARTEX cluster (Check Point), AS36352 HostPapaPlatform: no verdict

View all 19

Sources (1)