Evidence · DiggingBeagle record
Check Point Research: Hacking on Autopilot — Inside ARTEX Cybercrime Campaigns
Original Check Point recovery and analysis of ARTEX operator environments. It distinguishes iOS signing identity theft, writable application distribution assets, unsuccessful cryptocurrency withdrawals, exposed agent panels and game credentials across separately described operations; common framework use does not prove one attacker.
- Source role
- primary disclosure
Evidence record
Original Check Point recovery and analysis of ARTEX operator environments. It distinguishes iOS signing identity theft, writable application distribution assets, unsuccessful cryptocurrency withdrawals, exposed agent panels and game credentials across separately described operations; common framework use does not prove one attacker.
Claim-level citations (10)
- supportsARTEX crypto agents claimed withdrawals with no observed on-chain payout: Check Point counted approximately 292 domains, 230 findings and 400,791 messages, but observed no transactions to the cited recipient wallet. Vulnerability findings and successful HTTP responses cannot be counted as realized theft.
Cryptocurrency campaign; falsely claimed withdrawals; wallet verification
- supportsARTEX crypto agents claimed withdrawals with no observed on-chain payout: A four-day autonomous ARTEX campaign attacked hundreds of cryptocurrency payment domains. Agent logs treated apparently successful API replies as withdrawal achievements despite missing independent settlement proof.
Cryptocurrency campaign; falsely claimed withdrawals; wallet verification
- supportsARTEX campaign exposed over 190,000 game credentials; active accounts remain an estimate: Check Point recovered more than 190,000 records. Only 29 samples were validated and a roughly 6,000 active-account figure is an extrapolation, not independently verified accounts or a proven resale volume.
Game-services campaign; credential exposure; sample validation
- supportsARTEX campaign exposed over 190,000 game credentials; active accounts remain an estimate: An ARTEX campaign investigated gray-market game services and used application reversing plus exposed administrative credentials to reach publicly readable game account token material.
Game-services campaign; credential exposure; sample validation
- supportsARTEX campaign exposed over 190,000 game credentials; active accounts remain an estimate: Check Point reports more than 190,000 exposed game-account records, but its approximately 6,000 active-account estimate is extrapolated from a small validation sample rather than verified individually.
Honor of Kings service investigation and sampled credential validation
- supportsARTEX agents acquired hundreds of iOS signing identities; only three verified usable: Check Point reports more than 300 signing identities and three validated for usable signing. The paper does not demonstrate that compromised certificates signed or distributed malicious applications.
iOS app-signing campaign; certificate validation and impact
- supportsARTEX agents acquired hundreds of iOS signing identities; only three verified usable: Recovered ARTEX operator traces show agents probing ten iOS signing services through weak administrative controls and exploit paths, obtaining certificate bundles and corresponding password material.
iOS app-signing campaign; certificate validation and impact
- supportsARTEX agent operation reached writable iOS distribution pages through exposed S3 keys: Check Point verified access to objects underlying 714 landing pages and reported that the original manifest was restored. This demonstrates distribution tampering capability, not confirmed malicious app installs or client infection.
Cryptocurrency campaign; 714 application landing pages; S3 proof
- supportsARTEX agent operation reached writable iOS distribution pages through exposed S3 keys: An ARTEX operation found a publicly reachable application API that disclosed Amazon S3 access keys and then exercised write authority over a bucket supporting enterprise iOS installation pages.
Cryptocurrency campaign; 714 application landing pages; S3 proof
- supportsARTEX agent operation reached writable iOS distribution pages through exposed S3 keys: The ARTEX-related S3 access allowed alteration of the objects serving 714 enterprise iOS installation pages, but Check Point did not verify downstream malicious IPA installation through this access.
Enterprise app-distribution S3 bucket case and follow-up status