Chinese 🇨🇳 AI-assisted penetration testing framework ARTEX has fragmented into multiple rebranded forks after its GitHub repo went dark, with at least one operator deploying it alongside a live CVE-2026-75650 Magento RCE exploit and an IRC-based PHP implant.
Key findings:
- ARTEX has spawned at least six confirmed rebrands: ScopeWeaver, Tangora PTaaS, Horda, Meze, AegisLoop, and Bob Research Labs / THE GRIM REAPER. The core multi-agent orchestration architecture, PostgreSQL-backed task state, and Planner-plus-three-Workers model carry across all of them, making the shared lineage traceable even when product names and UIs are replaced. Hunt for the reaper-full project name and artex-linux-amd64 references in exposed internal paths.
- The Bob Research Labs / REAPER instance exposed two frontends on TCP ports 3001 and 443, ran LLM profiles backed by DeepSeek, GLM, Kimi, and Claude, and carried a bobresearch agent profile. The multi-LLM backend design means operators can swap inference providers without restructuring the attack pipeline, a capability gap that commodity red-team tooling does not yet reflect.
- CVE-2026-75650, an unauthenticated remote code execution flaw in Magento/Adobe Commerce, was actively staged in the Bob Research Labs environment using StyleSmuggler, the public PoC. Evidence of execution steps was present: Guest Cart creation, billing information manipulation, triggering the vulnerable checkout flow, and extraction of the Magento Report Identifier. The follow-up dropped cache.php and testnewbot.php, and an "IRC BOT DEPLOYED" message was logged.
- irc.php functions as a persistence-anchored IRC C2 implant. It connects to the password-protected channel mg_master, installs itself via an [@]reboot cron job, copies itself to hidden paths, supports multiple PHP execution functions, and accepts !Cmd@ and !Cmd@all commands for remote tasking. This is post-exploitation infrastructure, not a scanner artifact.
- Korean localization artifacts are widespread across forks: Korean strings embedded in Go code handling SMTP, Notes, and HTTP processing; a translate_go.py script mapping Korean and Chinese 🇨🇳 strings to English; and an artex-ko directory. Skills packages (skills-en-keep, skills-backup, skills-translated-en[.]zip, bob-research-skills-en[.]zip) show a deliberate workflow of collecting, translating, and repackaging attack playbooks covering SQL injection, SSRF, XSS, XXE, IDOR, command injection, cloud and container testing, and more.
Practitioner takeaway: If you work Magento incident response, look for cache.php, testnewbot.php, and irc.php in the webroot and cache directories. Check crontabs for [@]reboot entries pointing to PHP processes and outbound IRC connections from the web tier. For threat hunters tracking ARTEX-lineage infrastructure, exposed PostgreSQL instances with task-state tables, dual-port frontends (3001/443), and artex-linux-amd64 binary references in process or path artifacts are the fingerprint. The AhnLab ASEC report documents IOCs, credential exposures, and runtime artifacts found in the wild.
#DFIR_Radar
