Agentic Hacking in the Wild: How We Track ARTEX, CyberStrikeAI and Their Rebrands

In a few months, agentic hacking frameworks have gone from conference demos to incident reports. In these tools a language model plans the attack and a set of tools carries it out, from reconnaissance to exploitation and lateral movement, while an operator watches and approves steps from a web console. Most are open source and built for authorized testing, but some now show up in real attacks. Kaspersky documented CyberStrikeAI in attacks on education organizations in Africa and Latin America. Censys counted 1,465 hosts with an exposed ARTEX console and links the framework to campaigns that CrowdStrike and Microsoft reported, and RST Cloud mapped ARTEX, PentAGI and Cairn side by side.

All of these frameworks have a console, and operators often run it on a rented server, on a bare IP address and port. Anyone can load that page, so we can scan it and fingerprint it.

What we track

Each framework has a public hunt. Follow a hunt to get an email when it sights a new console.

A new name doesn't change the code

Operators rebrand. AntiFox appeared at the end of October and is ARTEX with the name swapped: it runs the same application and has the same API, and its title is ARTEX's own title template with a new brand in front. It also has its own icon, so a search for the ARTEX favicon finds none of the 91 AntiFox scans we hold. The hunting rule we wrote against the console's application code finds all 91. CyberStrikeAI shows the same pattern: 57 consoles that match its code rule carry another product name in the title, such as DesRedTeam, DarkAI or ZeroDusk.

So each hunt layers several fingerprints, from the easiest for an operator to change to the hardest:

• Titles, in every language a console ships (ARTEX ships Chinese, English, Japanese and Korean). They are cheap to change, but rebrands often keep the template: AntiFox — 自主渗透测试控制台.
• Favicons (MurmurHash3). Hashes published by other internet search engines don't always match ours, because each one hashes a slightly different file or encoding. Check a hash against a real scan before you rely on it.
• Certificates. PentAGI and CyberStrikeAI create a self-signed certificate with the product name as its issuer. CyberStrikeAI's certificate becomes valid one hour before the console starts, so its not before date shows when the console was last restarted.
• Server banners and password prompts. Some ARTEX operators put the console behind a password prompt. The page is then empty, but the prompt's name ("ARTEX Gateway") or a server that calls itself artex-authd still identifies it. Strix's dashboard identifies itself as StrixViewer.
• Code structure. Our JavaScript fingerprints hash a script's syntax tree with names and values stripped out, so a module keeps the same hash through new builds and renamed copies. The ARTEX hunt requires three of the console's modules together, so one small module that happens to look the same elsewhere can't cause a match.
• Hunting rules written against each console's own application code. They still match after the name, title and icon have changed.

Find them yourself with SMQL

Each query below opens in advanced search:

• hunting_rule:ARTEX_Console: ARTEX consoles under any name
• title:"自主渗透测试控制台" AND NOT favicon_hash:-576220750: consoles that keep ARTEX's title template but use a different icon
• server:"artex-authd": consoles behind ARTEX's own access-password server
• hunting_rule:CyberStrikeAI_Console AND NOT title:"CyberStrikeAI": renamed CyberStrikeAI consoles
• cert_issuer:"PentAGI CA" OR favicon_hash:1567951828: PentAGI, including renamed builds
• fp_canonical:cc0d8622…: ARTEX's login module, matched by its code structure (the link holds the full hash)

A match identifies the software, not the intent

Red teams use the same frameworks for authorized work. A sighting tells you that a console runs on a host, not who runs it or why. Treat it as a lead: look at what else the host serves, at the infrastructure around it and at public reporting before you call it hostile. Hunts check every new scan, so a console is sighted as soon as anyone scans it.