Analysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy Cat
Key Summary
Since the original ARTEX GitHub repository disappeared, there has been an increase in independent distributions and customized instances based on the existing ARTEX codebase. These distributions are being redistributed with the product name, UI, filesystem structure, agent settings, and language modified, while retaining traces of ARTEX.
Key Observations
- In several instances, ARTEX was retained as-is or rebranded under different names such as ScopeWeaver, Tangora PTaaS, Horda, Meze, AegisLoop, and Bob Research Labs.
- Some distributions were reengineered as autonomous penetration testing tools, security assessment tools, code audit tools, or general-purpose agent systems.
- Source code artifacts contained Korean strings within Go code related to SMTP, Notes, and HTTP processing, and
translate_go.Pycontained mappings that replaced Korean and Chinese strings with English. - An “artex-ko” directory and numerous Korean localization artifacts were also identified.
Case Study: Bob Research Labs / THE GRIM REAPER
- In the Bob Research Labs environment, different frontends were exposed on TCP ports 3001 and 443.
- A reference to
artex-linux-amd64was found in internal paths, and the project name had been changed toreaper-full. - The REAPER distribution retained ARTEX’s multi-agent orchestration structure, restoring task states from PostgreSQL and distributing tasks among the Planner and up to three Workers.
- LLM profiles based on DeepSeek, GLM, Kimi, and Claude, as well as the bobresearch agent profile, were identified.
Exploitation of CVE-2026-75650 and Follow-up Execution
- A working copy of StyleSmuggler—the publicly available PoC for CVE-2026-75650 (a Magento/Adobe Commerce remote code execution vulnerability exploitable without authentication)—was exposed in the Bob Research Labs environment.
- There were signs that the same steps as in the public PoC had been performed: creating a Guest Cart, manipulating billing information, triggering the vulnerable checkout flow, and extracting the Magento Report Identifier.
- Additionally, an “IRC BOT DEPLOYED” message, the generation of a cache.Php payload, and the files testnewbot.Php and irc.Php were identified.
- Irc.Php operates as a persistence-based IRC C2 (remote control channel) implant that connects to the password-protected #mg_master, and included features such as an @reboot cron job, copying of hidden paths, support for various PHP execution functions, and the ability to receive !Cmd@ and !Cmd@all commands.
Skills and Operational Characteristics
- A wide range of Agent Skills were identified, including API reconnaissance and testing, SQL injection, SSRF, XSS, XXE, IDOR, command injection, file upload testing, cloud and container security, mobile application testing, network penetration testing, secure code reviews, incident response, and vulnerability assessments.
- Artifacts such as
skills-en-keep,skills-backup,skills-translated-en.Zip, andbob-research-skills-en.Zipdemonstrate that Skills have been collected, translated, curated, and repackaged.
Overall Assessment
ARTEX is not a single project but is being reused, modified, localized, and redistributed by multiple operators. In the Bob Research Labs attack case, a customized ARTEX/REAPER build, additional Skills, multiple LLM backends, exploit development artifacts, and a follow-up attack flow based on CVE-2026-75650 were identified. At the same time, source code, credentials, development artifacts, runtime logs, and attack tools are widely exposed on the internet, indicating poor OPSEC practices.
