ARTEX Intel中文

THREAT TRACKER

ARTEX Intel

Tracking attacks, timelines and IoCs linked to ARTEX. Every entry carries its sources and a confidence level.

View timeline All IoCs

First public2026/07/26

Attack events25

Tool updates7

Days tracked103 days

IoCs2,435

Exposed instances2,208

LATEST

Latest intelligence

Event	Type	Region/Country	Confidence	Actor	IoC	Disclosed
Follow-on Korean financial intrusions	Data theft / theft of funds	South Korea	Confirmed	Unconfirmed	—	2026-11-05
ARTEX cybercrime operations	Cybercrime activity	—	Single-source, unverified	Cybercriminals	Has IoCs	2026-11-05
Public console counts	Exposure statistics	—	Multiple reports	—	Has IoCs	2026-11-05
Public detection rules	Detection rule publication	—	Multiple reports	—	—	2026-11-05
GitHub secrets to Azure exfiltration	Cloud credential abuse	Global	Single-source, unverified	Unattributed	Has IoCs	2026-11-05
Attacks on India's financial sector	Financial attack	India	Confirmed	CRAFTY FALCON	—	2026-11-04
Docker image poisoning	Poisoning	—	Confirmed	Unconfirmed	Has IoCs	2026-11-04
Chainstack breached	Intrusion / data theft	—	Confirmed	Unconfirmed	—	2026-11-03
WorkOS sales tool accessed	Data access	United States	Confirmed	Unconfirmed	—	2026-11-02
Mandiant incident response cases	Multiple intrusions (incident response)	United States	Confirmed	Multiple actors	—	2026-10-31

TREND

Public reports

View data table

KEYWORDS

Trending keywords

INDICATORS

Top IoCs

Domain

xcai[.]pro
u6ud2s[.]dnslog[.]cn
www[.]ddduuuppp[.]com
direct[.]xcai[.]pro
nginxmysql[.]com
sqlserver-sqlite[.]com

IP

144[.]172[.]64[.]128
144[.]172[.]64[.]60
144[.]172[.]64[.]99
38[.]244[.]50[.]120
154[.]201[.]79[.]246
205[.]214[.]59[.]31
1[.]14[.]104[.]208
108[.]165[.]147[.]226

Exposed

106[.]55[.]34[.]199:8443
106[.]55[.]34[.]199:8787
118[.]107[.]44[.]153:8787
118[.]107[.]44[.]161:8787
118[.]25[.]100[.]71:8787
120[.]48[.]16[.]142:8787
121[.]43[.]194[.]200:8787
180[.]178[.]51[.]170:80

Hash

3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4
8858508e75ac58ce586631101be87973
085f53a1ce8c634ac7b0d63e42b56b15
0c501aca4fc29efe47f122ddc9c1af85
0eb259067e565221109a3ee988e1faa3
220a1465b2c5ee3ec86861ee17a91e2f
2d13374c14bcaaa99ab00f16cc18b300
326bb512422930f723e8434d219bea15

TRACES

Sample traces

artex-ko
artex-linux-amd64
artex-probe-*
artex_probe_11876.txt
agt.py
agt4.py
bob-research-skills-en.Zip
C:\ProgramData\artx5v\
cache.Php
cl1217.jsp
extract_hprof.py
f1219a.jsp
graphics-hook-filter64.dll
graphics-hook_config.bin
irc.Php
LocaleMgr.exe
P.class
pivot_relay.ps1

For hunting only.

SAMPLES

Notable samples

Hash	Notes	Sources	Check
`3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4`	BLOODALCHEMY loader DLL (graphics-hook-filter64.dll)	CrowdStrike	Platform: malicious
`8858508e75ac58ce586631101be87973`	Malware/file linked to operational directories	AhnLab ASEC	Platform: malicious
`364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab`	BLOODALCHEMY payload file (graphics-hook_config.bin)	CrowdStrike	Platform: suspicious
`085f53a1ce8c634ac7b0d63e42b56b15`	Malware/file linked to operational directories	AhnLab ASEC	Platform: no record
`0c501aca4fc29efe47f122ddc9c1af85`	Malware/file linked to operational directories	AhnLab ASEC	Platform: no record
`0eb259067e565221109a3ee988e1faa3`	Malware/file linked to operational directories	AhnLab ASEC	Platform: no record
`220a1465b2c5ee3ec86861ee17a91e2f`	Malware/file linked to operational directories	AhnLab ASEC	Platform: no record
`2d13374c14bcaaa99ab00f16cc18b300`	Malware/file linked to operational directories	AhnLab ASEC	Platform: no record