Open Directory Exposes ARTEX-Assisted Campaign Targeting Japanese, Taiwanese, Korean, and US Enterprise Infrastructure
All findings are based on passive OSINT and Hunt.io AttackCapture data. No systems were accessed or exploited during this investigation. The staging server IP is withheld pending notification.
Key Takeaways
- An exposed open directory captured November 9, 2026 at 05:07 UTC revealed 1,235 files totaling 309MB across one subdirectory belonging to an active threat actor, with 566 files flagged malicious, confirming the operation was live throughout
- The toolkit combines the ARTEX AI offensive framework with twelve distinct exploitation categories covering Apache ActiveMQ, Advantech WebAccess ICS, F5 BIG-IP, Palo Alto GlobalProtect, Apache Struts2, Redis, MikroTik Winbox, phpMyAdmin, RuoYi, ThinkPHP, n8n, and Jenkins
- CVE-2023–46604 exploitation against a Taiwanese ActiveMQ instance on non-standard port 1555 is confirmed through a callback log recording the target fetching the operator’s malicious Spring XML payload from
/k1365/testX.xml - Structured callback result files (
act_jp.jsonl161KB,act_tw.jsonl,act_us.jsonl) generated in a single operator session on November 6 between 19:06 and 19:13 UTC show the campaign extended beyond East Asia to include US infrastructure artex_optimize.shmodified November 6 places this operation inside the broader wave of AI-assisted intrusions documented across East Asia in October–November 2026c2.txtcontains a captured phpMyAdmin administrative session cookie for107.167.177.120, andamq1555_tw_cb.logconfirms RCE callback from a Taiwanese target — two distinct confirmed compromises from a single exposed directory
Discovery
This investigation started on Hunt.io’s New Open Directories feed — real-time AttackCapture discoveries, things that appeared in the last few hours with no prior reporting anywhere.
At 05:07 UTC on November 9, 2026, AttackCapture crawled a staging server and found 1,235 files totaling 309MB across one subdirectory, sitting fully exposed on a public HTTP port. Of those files, 566 were flagged malicious. The most recent file modification timestamp was November 6 — three days before discovery.
This was not an abandoned research project or a misconfigured backup. This was a live operation.
Scale of the Operation
The file list alone told part of the story. The Legacy AI Summary told the rest.
This is not a single-CVE campaign. The actor built a comprehensive offensive toolkit covering twelve distinct exploitation categories, all running in parallel against country-segmented target lists:
Apache ActiveMQ — amq_proof.py — CVE-2023–46604 RCE, CVSS 9.8
Advantech WebAccess ICS — advantech_webaccess_crystalrpt_unauth_file_upload_rce.py — Unauthenticated file upload RCE
F5 BIG-IP — i1400_f5p.sh — Known BIG-IP path exploitation
Apache Struts2 — s2* scripts — OGNL injection RCE
Palo Alto GlobalProtect — pa_*.py — Path traversal
phpMyAdmin — pma_try.py — SQL OUTFILE webshell write
Redis — rogue_master.py, rexploit.py — Rogue master persistence and payload delivery
MikroTik Winbox — WinboxExploit.py, extract_user.py — Credential extraction from user.dat
RuoYi admin panel — capbrute.py — Math captcha brute force
n8n workflow automation — n8n scripts — RCE
ThinkPHP — ThinkPHP scripts — RCE
Jenkins — Jenkins job scripts — Remote job creation RCE
An actor running twelve exploitation categories simultaneously against four countries is not opportunistic. This is a coordinated, resourced operation with clear geographic focus.
Target Geography
The country-segmented target lists define the operation’s scope. What started as a three-country picture expanded to four when the act_us.jsonl callback file appeared.
Target lists by country:
all_jp.txt— 158KB — Japan, IP:port entries on 8080/8443/8000all_tw.txt— 27.6KB — Taiwanall_TW.txt— 1.1KB — Taiwan supplementary listb_jp.txt— 1.12KB — Japan subsetb_kr.txt— 1.14KB — Koreabi_pool_all_tw.txt— 111KB — Taiwan business intelligence platform poolbi_pool_hot_tw.txt— 28.3KB — Taiwan high-priority targetsapnic.txt— 4.15MB — Asia-Pacific IP registry reference for range targeting
The bi_pool files are particularly significant. They represent pre-filtered targets — systems already identified as running exposed business intelligence platforms. That is not raw scan output. That is a prioritized target queue ready for exploitation.
The act_*.jsonl callback result files confirm active exploitation across all four geographies:
act_jp.jsonl— 161KB — Japan, the primary targetact_tw.jsonl— 3.41KB — Taiwanact_us.jsonl— 1.16KB — United Statesact_mini.jsonl— 17.8KB — high-value subset
All four were generated in a single operator session on November 6 between 19:06 and 19:13 UTC — eight minutes of automated batch processing across four countries.
The Operator’s Workflow — Reconstructed
The .bash_history file shows the exact sequence of commands the operator ran on this machine. Hunt.io’s AI analysis: “Bash history shows FOFA API queries, Python helpers, scanning/enumeration for Apache Druid/Flink, use of /dev/shm staging, and visible API keys.”
Stage 1 — Discovery via FOFA
The operator used FOFA, the Chinese internet asset search engine, to discover exposed services across Japan, Taiwan, Korea, and the US. Apache Druid and Apache Flink — big data processing platforms widely deployed in East Asian financial and technology sectors — were specifically targeted in the enumeration queries. Results fed the country-segmented target lists.
Stage 2 — Business Intelligence Reconnaissance
bi_stage1.py is a high-concurrency scanner that reads the target pool, issues HTTP/HTTPS GET requests, and searches responses for Metabase, Superset, and Airflow — three widely deployed business intelligence and data pipeline platforms. Hits are recorded to out.jsonl with MD5 fingerprints for follow-on exploitation. Last modified November 4.
Stage 3 — Multi-Vector Exploitation
With targets identified, the toolkit fires across all twelve categories simultaneously.
For ActiveMQ targets, amq_proof.py generates malicious Spring XML payloads and sends exploit frames to OpenWire brokers on port 61616. cb_server.py runs alongside as a callback listener — when a vulnerable instance processes the frame and fetches the payload, the request is logged as confirmation of RCE.
The two Advantech WebAccess logs from November 2 are the clearest evidence of active ICS exploitation. batch_20261102_201619.log and batch_20261102_201732.log contain real-time output — target IP lists, HTTP 500 responses, Python tracebacks, and connection resets from active exploitation runs against industrial control system infrastructure.
For MikroTik routers, WinboxExploit.py extracts the user.dat credential store and extract_user.py decrypts it — giving the operator plaintext credentials for every configured account.
For Redis instances, rogue_master.py sets up a rogue Redis master server that serves malicious payloads to vulnerable clients that replicate from it — a persistence technique that survives service restarts.
Stage 4 — ARTEX Orchestration
Get H3NRY B41T’s stories in your inbox
Join Medium for free to get updates from this writer.
artex_optimize.sh ties the multi-stage workflow together. Modified November 6, it represents the most recent operational development activity before discovery. ARTEX coordinates reconnaissance, exploitation, and collection without requiring manual direction at each step.
The /dev/shm staging noted in .bash_history is a deliberate anti-forensics choice. /dev/shm is a Linux memory-based filesystem — files written there exist only in RAM and disappear on reboot, leaving no persistent disk artifact for forensic recovery.
Confirmed Compromises
Two distinct compromises are confirmed from artifacts in this directory.
Compromise 1 — phpMyAdmin Administrative Access
c2.txt is 482 bytes and the most significant credential artifact in the directory.
Hunt.io’s AI analysis: “Netscape-format cookie file generated by libcurl. Contains phpMyAdmin cookies and session token for IP 107.167.177.120; may enable administrative access.”
This is a captured administrative session cookie stored in libcurl’s Netscape format for reuse. The operator authenticated to the phpMyAdmin instance at 107.167.177.120 and stored the session. phpMyAdmin provides a web interface for MySQL database administration — administrative access means read and write access to every database on that server. Last modified November 5.
Compromise 2 — CVE-2023–46604 RCE Callback, Taiwan
amq1555_tw_cb.log records something more specific than a scan result.
Hunt.io’s AI analysis: “Repeated requests from same IP to /k1365/testX.xml using curl UA.”
This is the out-of-band callback pattern generated when a vulnerable ActiveMQ instance processes a malicious OpenWire exploit frame and fetches the operator’s Spring XML payload from the callback server. The target was running ActiveMQ on non-standard port 1555 — the operator specifically fingerprinted and targeted this non-standard deployment rather than relying on default port 61616 scanning. Repeated requests from the same IP confirm the payload was fetched multiple times, consistent with successful exploitation. Last modified November 5.
Operation Timeline
November 2, 2026 — Active Advantech WebAccess ICS exploitation against Taiwan target pools
Evidence: batch_20261102_201619.log, batch_20261102_201732.log
November 4, 2026 — Japan target list finalized, bi_stage1.py and capbrute.py modified
Evidence: all_jp.txt, bi_stage1.py, capbrute.py timestamps
November 5, 2026 — ActiveMQ exploit updated, phpMyAdmin session captured, Taiwan RCE callback confirmed
Evidence: amq_proof.py, c2.txt, amq1555_tw_cb.log timestamps
November 6, 2026 — ARTEX framework optimized, Japan/Taiwan/US callback results generated 19:06–19:13 UTC
Evidence: artex_optimize.sh, act_jp.jsonl, act_tw.jsonl, act_us.jsonl
November 9, 2026 05:07 UTC — Directory discovered by Hunt.io AttackCapture — 1,235 files, 309MB, 566 malicious files
Evidence: First capture
Why ARTEX Changes This
ARTEX is not just another tool in the toolkit. It is what connects this operation to a documented pattern.
Since its public release in July 2026, ARTEX has appeared in confirmed intrusions against South Korean financial institutions, documented by CrowdStrike in October 2026. Hunt.io’s own research identified over 1,300 ARTEX-tagged IP addresses globally, with console titles appearing in English, Chinese, Korean, Japanese, Russian, Portuguese, and Vietnamese indicating adoption across multiple threat actor communities.
The presence of artex_optimize.sh on this server, modified three days before discovery, means this operator was actively developing and tuning their ARTEX deployment while simultaneously running conventional exploitation tooling. This is the operational pattern that makes AI-assisted intrusions harder to disrupt — the AI layer keeps working while the operator refines the conventional tools around it.
MITRE ATT&CK Matrix
Reconnaissance — Active Scanning (T1595)
FOFA API queries, masscan logs, probe scripts
Reconnaissance — Gather Victim Network Information (T1590)
bi_stage1.py BI platform enumeration
Reconnaissance — System Language Discovery (T1614.001)
Locale detection in multiple scripts
Initial Access — Exploit Public-Facing Application (T1190)
CVE-2023–46604, Advantech WebAccess, F5 BIG-IP, Struts2, GlobalProtect
Execution — Command and Scripting Interpreter: Python (T1059.006)
amq_proof.py, bi_stage1.py, capbrute.py, WinboxExploit.py
Execution — Windows Command Shell (T1059.003)
Payload scripts confirmed in AI Summary
Persistence — Server Software Component: Web Shell (T1505.003)
pma_try.py SQL OUTFILE webshell attempts
Persistence — Exploitation for Persistence (T1190)
Redis rogue master payload delivery
Defense Evasion — Virtualization/Sandbox Evasion (T1497.001)
System checks in multiple scripts
Defense Evasion — Data Staged: Local Staging (T1074.001)
/dev/shm memory-only staging
Credential Access — Credentials from Password Stores (T1555)
WinboxExploit.py extracting user.dat
Credential Access — Steal Web Session Cookie (T1539)
phpMyAdmin session cookie in c2.txt
Credential Access — Brute Force (T1110)
capbrute.py RuoYi math captcha bypass
Discovery — System Information Discovery (T1082)
Fingerprinting scripts across target lists
Discovery — System Network Configuration Discovery (T1016)
Network enumeration in probe scripts
Collection — Automated Collection (T1119)
batch_run.sh, bi_stage1.py automated scanning
Command and Control — Application Layer Protocol: Web (T1071.001)
cb_server.py, oob.py HTTP callback listeners
Indicators of Compromise
Network Indicators
107.167.177.120 (IPv4)
Confirmed compromised phpMyAdmin instance
/k1365/testX.xml (URL path)
CVE-2023–46604 Spring XML payload delivery path on operator callback server
Port 1555 (Non-standard port)
Targeted Taiwanese ActiveMQ deployment
CVE-2023–46604 (CVE)
Apache ActiveMQ RCE, CVSS 9.8
File Hashes (SHA-256)
artex_optimize.sh
ba8b0689388a2c07320d2257335f56d2690be76bff8a82a78d9e1a2db1fd3e16
2026–11–06
amq_proof.py
ed419620e3e3a10a4360313892bd9a39e84e8f4a47957dc97c6167a705816955
2026–11–05
bi_stage1.py
a57dc9236beaec48e8a1bbc2128654afa9994a62e53a79cb418b75c14f5c800c
2026–11–04
capbrute.py
8ba55951f0b84ba00b1d976df555f8f4d765dc6d5c7cd4205dbdca83abf9bd11
2026–11–04
cb_server.py
84df1bd248b12d40d9ed83642aa0b537749f754d3aa82ad054883fe5683d379e
2026–11–05
batch_20261102_201619.log
3a4463e26d5dc252431822d04584d20cbb5552c9c6af529a0c9c4a5d09041a1f
2026–11–02
batch_20261102_201732.log
2d10e6f42b3d55ca393ef489002b2a490d05c63ee561c507ef0e3e403a051462
2026–11–02
c2.txt
c6dcf8f253f49af2358b87b40148f1e3a04740589818872fb779173f8c2f6964
2026–11–05
amq1555_tw_cb.log
4cedc5082bc05b7981311e90306873fe8fc3e8ce384438f03389502205be58ad
2026–11–05
act_jp.jsonl
bd5ef9be5533f55ab9d6cc88d93125709d7c871314db9861407e340c9e9a0845
2026–11–06
act_tw.jsonl
efb105bde4d5087aa8423ca0ee1950e6c7cd64c0a8d38224061df1565aef0bd6
2026–11–06
act_us.jsonl
6918a56f0e2e7880261a04afc19d1d13b8479327e305e3e96f985ade750007da
2026–11–06
.bash_history
fc38b6e4e0fe1e11052475a38cf795681f018b033d79c0c158dbd1dd26fa5739
2026–11–05
all_jp.txt
ee6fe8261b27dd23b580ab37d26ee9c1b3cebfdacb1c057ea37e54465600025d
2026–11–04
Host Artifacts
/dev/shm
Memory-based staging — no disk artifact on reboot
/k1365/testX.xml
CVE-2023–46604 payload delivery path
out.jsonl
bi_stage1.py BI reconnaissance output
Conclusion
Open directories expose more than files. They expose intent, tradecraft, and operational tempo in a way that no single malware sample or network indicator can.
This one exposed all three — and kept exposing them while the operator continued working. Between first capture at 05:07 UTC and a second observation seven hours later, 138MB of new files appeared: new target lists, new callback results, a new subdirectory. The operation did not pause because a researcher was watching. It kept running.
The actor built something serious: FOFA-driven target discovery feeding country-segmented lists across Japan, Taiwan, Korea, and the US, twelve parallel exploitation categories covering everything from Apache ActiveMQ to MikroTik routers to industrial control systems, ARTEX orchestrating the workflow, and two confirmed compromises — a captured phpMyAdmin session and a confirmed CVE-2023–46604 RCE callback — proving the pipeline was producing results.
The /dev/shm staging shows awareness of disk forensics. The ARTEX integration shows awareness of operational efficiency. The eight-minute window between Japan, Taiwan, and US callback result generation shows automated batch processing at a scale no manual operation could match.
For defenders: patch CVE-2023–46604 immediately if Apache ActiveMQ is in your environment, including non-standard ports. Audit internet-facing Advantech WebAccess installations. Check Redis instances for unauthorized replication. Monitor for FOFA-sourced scanning activity and anomalous phpMyAdmin authentication. If you are running ActiveMQ on a non-standard port believing obscurity provides protection, this operation specifically targeted non-standard deployments.
