LLM-driven pentest framework ARTEX exposed: one FOFA query finds 300+ live panels
cyb3rops · x · 2026-10-30
Threat intel account MalGamy12 is tracking ARTEX, a Chinese-built, LLM-driven autonomous penetration testing framework.
- A single FOFA favicon query (iconhash="-576220750") surfaces 425 results across 300+ unique IPs of live control panels, concentrated in the US (136) and Hong Kong (81)
- Screenshots show nginx-hosted ARTEX/AREX login pages with little exposure hardening
- A sign that LLM-driven offensive tooling is deployed in the wild — and that its own control planes have become a mappable attack surface
More from coding & agent
- Building a Black Friday deal-hunting agent: agentic commerce starts with discounts — jeff_weinstein · 2026-10-30
- Sentry CEO on agent determinism: why system prompts are almost never the answer — zeeg · 2026-10-30
- Claude Opus autonomously builds a walkable 3D IKEA room from product photos via HF agents — victormustar · 2026-10-30
- claude-obsidian hits 16k stars: Claude Code auto-builds and maintains a linked Markdown knowledge vault — JeremyCMorgan · 2026-10-30
- openrock launches: one open-source chat app for every AWS Bedrock model — maelswarm · 2026-10-30
- Arc: a 70 MB streaming speech model that does ASR and entity linking in one step — Working_Hat5120 · 2026-10-30