Hosts with publicly exposed management panels for the ARTEX AI penetration-testing platform numbered 1,465 worldwide and 51 in Japan. The observation was conducted on 3–4 November 2026, and the presence of other threat tools on the same hosts was also confirmed.
Censys, a US-based internet observability company, investigated the public exposure of ARTEX and reported that management panels accessible externally were found on 1,465 hosts worldwide, including 51 identified as being located in Japan. The standard port is 8787, although some instances use other ports or web traffic ports. Censys explained that an authentication screen being visible externally is distinct from the management functions being operable without authentication.
The survey found that 650 of the publicly exposed hosts had nearly identical port configurations, with 493 attributed to PEG Tech and 157 to Yancy Limited. Censys pointed to the possibility of automated deployment templates and multiple-IP configurations, and stressed that the 1,465 hosts cannot be directly cited as the number of attacker-operated infrastructure platforms.
The 51 hosts in Japan do not indicate domestic victims and are limited to observations of the locations of publicly exposed servers. The survey also identified cases in which ARTEX and another AI penetration-testing platform were operated on the same host, as well as cases involving co-located C2 tools such as Vshell, Cobalt Strike and Adaptix C2.
In addition, 32 publicly exposed directories associated with ARTEX hosts contained files and histories that could be used for post-compromise operations, drawing attention as traces of attack activity. Past incidents have also been reported in which ARTEX configuration information and session histories were found in attacks on South Korean financial institutions. Defenders are therefore urged not to assess the threat based solely on public exposure, but to verify it by correlating multiple types of activity.