Exposed operator records show ARTEX agents carrying out cybercrime with limited interaction after their operators set goals, according to Check Point Research’s November 5, 2026 report. The researchers examined databases exposed by 10 misconfigured instances.
One campaign targeted iOS signing-certificate sellers between October 14 and 29. Check Point says agents obtained more than 300 certificates and passwords; only three passed validation.
In a separate cryptocurrency operation, agents compromised infrastructure, yet the wallet identified by researchers showed no transactions. Some cashout claims rested on API responses rather than completed transfers.
These findings concern the inspected campaigns; they do not establish that every ARTEX deployment is criminal. For defenders, the practical priority is familiar: eliminate exposed credentials, protect administrative secrets and enforce authentication on APIs. These were weaknesses the researchers observed agents exploiting.
