ARTEX agents stole 300 Apple certs for under $1,500

ARTEX was originally released as an open-source penetration-testing platform meant for authorized security work. After the tool was observed in attacks against South Korean banks, its developer made the project closed-source on October 8th, but maintained forks and backups kept it publicly available to threat actors. Following the deletion of the original repository on September 8, the number of newly created ARTEX command-and-control servers spiked in mid-October, coinciding with prominent public reporting about the project.

The operator-console artifacts Check Point Research obtained show how little human input these campaigns require. In the gaming account theft campaign, for example, agents pointed at thirteen credential-server sites recovered more than 190,000 sets of credentials for Honor of Kings alone, of which roughly 3.3% — about 6,000 accounts — tested as still valid. In the crypto campaign, agents did find real vulnerabilities, including an unauthenticated web API that leaked AWS S3 credentials and allowed write access to a bucket serving iOS app landing pages, but the original manifest was later restored by the bucket owners and the attacker's wallet stayed at $0.

The infrastructure data points to relatively unsophisticated hosting choices: 882 of the live servers, or 54%, were hosted in the US, followed by Hong Kong at 295 and China at 103. Because the systems run in default configurations with default tools, the barrier to entry appears low — a factor that may make broad, opportunistic attacks more common for defenders to handle (this last point is an inference from the observed defaults).