ARTEX Intel中文

Timeline

Public ARTEX console counts

Event date2026-10-07 to 2026-11-05
Disclosed2026-11-05
TypeExposure statistics
ConfidenceMultiple reports

Methods and dates differ by vendor. AhnLab cautions that these IPs cannot all be treated as attacker addresses. Censys says about 650 are hosts with the same configuration, and about 815 deployments are actually distinguishable.

Figures and definitions

AhnLab394 (Oct 7); 600 IPs (Oct 14); about 900 estimated (Oct 14)
RST Cloud834 verified (Nov 2)
Censys1,465 (summary says Nov 4, body says Nov 3)
BadByte1,645 (Nov 4)
Hunt.ioAbout 1,300 (Nov 4)
Check Point1,608 online, 2,557 historical; Key Points says 1,800+
ThreatBook Feed2,151 IP:port pairs (as of Nov 5)
SOCRadarAbout 600 to 3,600+ IPs (X post, Nov 5)

Related IoCs

TypeValueRoleCheck
ASNAS138415Yancy Limited: 157 hostsSource report only
ASNAS54600PEG Tech: 493 hosts across 13 /24 networksSource report only
Network range156[.]234[.]0[.]0/16mostly hosts the 157 AS138415 hostsSource report only
Network range198[.]200[.]59[.]85-89cluster tag sco-fix2, AS54600 PEG TECH INC, USASource report only
Network range38[.]11[.]173[.]0/24125 hostsSource report only
Network range38[.]11[.]173[.]1-125cluster tag sco-fix2, AS54600 PEG TECH INC, USASource report only
Network range38[.]11[.]221[.]0/24125 hostsSource report only
Network range38[.]11[.]221[.]1-125cluster tag sco-fix2, AS54600 PEG TECH INC, USASource report only
FingerprintARTEX - Autonomous security assessment consoleConsole HTTP title used for Hunt.io searchesSource report only
FingerprintARTEX - Bảng điều khiển kiểm thử xâm nhập tự độngConsole HTTP title used for Hunt.io searchesSource report only
FingerprintARTEX - Console de Teste de Penetração AutônomoConsole HTTP title used for Hunt.io searchesSource report only
FingerprintARTEX - консоль автономного пентестаConsole HTTP title used for Hunt.io searchesSource report only
FingerprintARTEX - 自主渗透测试控制台Console HTTP title used for Hunt.io searchesSource report only
FingerprintARTEX - 自律型ペネトレーションテスト管理画面Console HTTP title used for Hunt.io searchesSource report only
FingerprintARTEX - 자율 침투 테스트 콘솔Console HTTP title used for Hunt.io searchesSource report only
FingerprintARTEX: Autonomous Penetration Testing ConsoleConsole HTTP title used for Hunt.io searchesSource report only
Fingerprint^ARTEX[ :—]page title regexSource report only
Fingerprintdev-db-resilience-20261031ARTEX cluster changing version tagSource report only
Fingerprintsco-fix2ARTEX cluster version tagSource report only
Hash085f53a1ce8c634ac7b0d63e42b56b15Malware/file linked to operational directoriesPlatform: no record
Hash0c501aca4fc29efe47f122ddc9c1af85Malware/file linked to operational directoriesPlatform: no record
Hash0eb259067e565221109a3ee988e1faa3Malware/file linked to operational directoriesPlatform: no record
Hash220a1465b2c5ee3ec86861ee17a91e2fMalware/file linked to operational directoriesPlatform: no record
Hash2d13374c14bcaaa99ab00f16cc18b300Malware/file linked to operational directoriesPlatform: no record
Hash326bb512422930f723e8434d219bea15Malware/file linked to operational directoriesPlatform: no record
Hash4fff3a0e67210deea726a3bd8c0b625fMalware/file linked to operational directoriesPlatform: no record
Hash5881f74d3bb167e48f6e61c8d9c220e7Malware/file linked to operational directoriesPlatform: no record
Hash5a38c92fcf2772f65517485f3a23810eMalware/file linked to operational directoriesPlatform: no record
Hash5d151bb4512fc48932a83d3bc24ea806Malware/file linked to operational directoriesPlatform: no record
Hash6593d2601f967566ae1efe521ec7b470Malware/file linked to operational directoriesPlatform: no record
Hash773dc8997a50425fb4146161d747c10fMalware/file linked to operational directoriesPlatform: no record
Hash78c3efc26c8db056933da58032361706Malware/file linked to operational directoriesPlatform: no record
Hash8858508e75ac58ce586631101be87973Malware/file linked to operational directoriesPlatform: malicious
Hash912e8bb04a86f34c76d7d9bad8b67685Malware/file linked to operational directoriesPlatform: no record
Hashbaddd4d75a6980e0df8d47333d9472c3Malware/file linked to operational directoriesPlatform: no record
Hashbe4033d98dd65437516a94048adc8ac5Malware/file linked to operational directoriesPlatform: no record
Hashfec5d7eb6cf4ed6cfbcd2c588bb761afMalware/file linked to operational directoriesPlatform: no record
IP1[.]14[.]104[.]208ARTEX and PentAGIPlatform: malicious
IP1[.]14[.]193[.]53two ARTEX consoles, Vshell, NPS, Gophish, and a mail server admin panelPlatform: suspicious
IP101[.]42[.]4[.]91ARTEX consolePlatform: no verdict

View all 2268

Sources (9)