ARTEX: Agentic Asbestos
Censys detects 1,465 hosts running exposed instances of ARTEX, an open-source, LLM-driven autonomous pentesting framework that has been linked to malicious activity from multiple threat groups.
Author
Silas Cutler
10 posts
Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet
Most deployments of the NPS tunneling tool are benign. Some are not. Censys ARC shares signals for distinguishing the benign from the malicious.
Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption
New Censys ARC research examines an exposed server containing Moobot botnet source code, active attack records, DoS tooling, and a fraudulent identity verification service.
Rhadamanthys and the Limits of Private Sector Operations
Explore the limits of private-sector threat intelligence through a 2022 Rhadamanthys infostealer case study. SANS CTI Summit research on harm reduction without law enforcement support.
Hunting Cameras in the Dark: Finding Internet Cameras Before Adversaries Do
Discover how Censys identifies Internet-exposed IP cameras in Iran using threat intelligence, CVE data, and advanced search queries.
Vshell: A Chinese-Language Alternative to Cobalt Strike
A Go-based C2 tool used in threat operations. Learn about its Cobalt Strike parallels, evolution, and threat intelligence insights.**
OpenClaw in the Wild: Mapping the Public Exposure of a Viral AI Assistant
Discover how OpenClaw, the open-source AI assistant, surged to 21,000+ exposed instances in one week. Silas Cutler analyzes the security risks and threat intelligence behind this rapid adoption.
Investigating the Infrastructure Behind DDoSia's Attacks
Discover Censys research on DDoSia, the pro-Russian hacktivist DDoS tool by NoName057(16) targeting Ukraine and NATO. Threat intelligence on infrastructure, tactics, and tracking.
2025 State of the Internet: Malware Investigations
**Discover how Censys Research uncovered BeaverTail, Wainscot malware & Secret Blizzard APT infrastructure. Key findings from the 2025 State of the Internet Report.**
2025 State of the Internet: Notable Incidents
Explore Censys' 2025 State of the Internet Report: deep analysis of Cl0p ransomware, Cleo file transfer vulnerabilities (CVE-2024-55956), and key 2024 threat intelligence findings.