ARTEX is written in Go and turns goals typed in plain language into commands carried out by AI agents, with little human input after the objective is set. It has no model of its own and connects to outside providers, including Anthropic‘s Claude, OpenAI‘s GPT and models such as DeepSeek, GLM, Grok and Kimi. On attacker-controlled instances, Chinese models are most common, led by the DeepSeek Flash family, which the FBI said combines capability, low cost and “lack of observable guardrails when framed for penetration testing” [1].The alert cites attacks on South Korean financial institutions that exfiltrated personal information on about 67,000 people, and a supply chain compromise of ConnectWise Cloud Backup customers that gave access to more than 2,250 downstream tenants [1]. Microsoft has tied the ConnectWise attack to Chinese state-backed actors, and Amazon published research on Friday describing Chinese-linked groups using ARTEX to steal AI model credentials, with the stolen keys paying for the inference behind further credential theft [2][3].The developer, “Autumn-27,” released ARTEX on GitHub in July, according to the FBI, and pulled the repository on Oct. 8 after reports of abuse, saying it was meant for authorized testing [1]. The Record identified the developer as Chinese security engineer Li Puhua [2]. Community forks, mirrors, archived copies and a commercial ARTEX PRO version keep it available, and Censys counted more than 1,600 publicly exposed ARTEX consoles as of early November [1].
Click Here For The Original Source.
——————————————————–
