ARTEX AI-Linked Infrastructure Observed Scanning UK CNI: Discovery and Associated Services

Infrastructure Analysis and Tracking

We identified 65 IPs across 13 country locations and 35 ASNs, concentrated in the United States (29), China (12), and Hong Kong (7). The strongest address clustering was in 38.11.173.0/24 (8 IPs) and 38.11.221.0/24 (6), all under AS54600 with Cogent organisation labels. Tencent-associated AS45090 followed with 8 IPs in China.

---

External reporting

Recently, Team Cymru S2 post shared a post on ARTEX.

Additional Services

In addition to ARTEX, BCON CTI analysed our host dataset to identify additional capabilities or services running on other ports, in order to add context into subplementary toolsets and new detection opportunities. Below is a summary of these findings, of which, all are tracked in our malicious infrastructure tracking platform.

• ToShell is a lightweight command-and-control (C2) framework with a team server, web console, and cross-platform agents. It supports payload generation, session management, and remote task execution.

• CyberStrikeAI is an open-source AI-assisted security-testing platform that coordinates security tools and agent workflows. Its web interface supports managing testing activity and reviewing results.

• Cobalt Strike is a commercial adversary-simulation platform used by red teams to emulate attacker activity. Its Beacon component receives tasks from a team server and returns execution results.

• Gophish is an open-source phishing-simulation framework for creating campaigns, sending test emails, and tracking recipient responses. A Gophish-labelled certificate alone does not establish that a Gophish instance is running.

• Adaptix C2 is an extensible post-exploitation and adversary-emulation framework for penetration testers. It combines a team server, operator client, and agents for managing remote sessions.

• Strix is an open-source AI penetration-testing tool for identifying and validating application vulnerabilities. The observed Strix-labelled report page does not establish that this specific project or a running Strix agent is present.

---

Assessment

For CNI defenders, the immediate value of these findings is a set of infrastructure leads to investigate alongside scanning of exposed systems. Review connections from the identified IPs to determine which services were reached, whether requests attempted exploitation, and whether any activity progressed to authentication or endpoint execution. Distinguishing routine probing from activity requiring response helps focus investigation on systems supporting essential services. The observed scanning alone does not establish compromise.

The additional services give those investigations useful context. Some ARTEX-discovered IPs also expose interfaces or signatures associated with phishing, remote control, and post-exploitation tools. That makes them relevant leads for correlating network and endpoint evidence, but it does not show that all services share an operator.

The broader observation is that AI-assisted security-testing platforms are appearing alongside established offensive tools in internet-facing infrastructure. For defenders, this supports tracking AI-assisted tooling through the same evidence used for other activity: source infrastructure, requests against exposed services, process execution, and subsequent connections.