One Operator, Several AI Attack Agents: The Ultra Suite and ARTEX

An operator in Hong Kong is running several AI attack frameworks against internet-facing web applications and rotating through a commercial residential proxy pool to do it. In late October 2026, during an active engagement, Profero IRT observed this operator run ARTEX alongside a private suite that wraps a VulnHunter instance, Hermes Agent, a reverse-engineering console and, earlier, CyberStrikeAI. A Cairn AI penetration-testing platform runs in the same network range, but Profero has no evidence it was used against the targets.

An active operator is chaining ARTEX and a private suite of AI attack agents behind a 273,000-node residential proxy pool, already hitting multiple customers with a high success rate across web applications, APIs and mobile applications, with injection payloads that match no known tool signature. Scanning preceded exploitation by days, and Profero has not identified a sector focus: treat the targeting as opportunistic. Profero’s advisory of 23 October 2026 described these frameworks. This is the first time Profero has seen one operator chain them.¹

Severity: High. Block the operator’s infrastructure now. The indicator appendix lists 63 IP addresses and 3 domains, and the CSV downloads are ready for import into firewalls and web application firewalls (WAFs).

• Block: import the Block Now list into the perimeter firewall and WAF, and alert on hits.
• Harden the edge: lock the origin to your edge provider, run generic SQL injection rules in blocking mode after a log-only run, and challenge proxy traffic on login and admin paths. WAF and edge guidance gives the settings.
• Hunt: search logs back to 1 August 2026 for the indicators in Hunting. A confirmed hit means an active intrusion: contact Profero IRT before remediating.

What we see

• Operator infrastructure: three hosts in one Hong Kong hosting network. One is the attacking host. One is the origin for an operator-registered domain and runs a password-protected SOCKS5 relay. One runs the “Ultra Reverse” console. All three carry a custom “Ultra” brand (HTTP Basic authentication realm “Ultra”, an “Ultra Reverse” certificate) on the same Ubuntu 22.04, nginx and OpenSSH 8.9p1 build. No other host in Profero’s internet scan searches carries this combination. The domain, with www and wiki subdomains, moved behind Cloudflare on 21 September 2026 and its function is not known. The addresses, domain, certificates and keys are in Block now, Hunting and the indicator appendix.
• The private “Ultra” suite: an operator-built console, not a public product, that wraps several agent tools behind HTTP Basic authentication. The domain host serves a panel titled “Ultra - VulnHunter” (the title is verbatim) and a Hermes Agent dashboard. The panel is most likely Clouditera’s VulnHunter, a Chinese AI vulnerability workbench that generates proofs of concept, though Profero has not confirmed which build.² Hermes Agent is a general-purpose open-source agent.³ The third host runs the “Ultra Reverse” console, an LLM-driven static reverse-engineering tool. In August and September 2026, the domain host ran CyberStrikeAI⁴ on port 8080.⁵
• ARTEX: the attacking host requested ARTEX probe files (artex-*) from the targets.⁶ It also serves port 8787, the ARTEX console default, behind an nginx login. On its own that port is only corroborating. ARTEX’s default user agents (norma/0.4, artex-selfupdate) did not appear.
• Cairn, next door: one server answered on 60 addresses in the same /24 between mid-September and 8 October 2026, and was still live on 31 October. It runs Cairn, an open-source AI penetration-testing framework,⁷ branded “Cairn CF Platform” and “cf 作战平台” (CF ops platform), with Codex, Claude and Pi workers and presets for the DashScope, DeepSeek and Kimi model providers. Five cluster members also serve port 8787. Profero has no evidence that Cairn was used against the targets. It is listed because it shares the operator’s /24, serves port 8787 on five cluster members and is an AI attack platform in active use. Treat it as adjacent infrastructure, not as part of the attack.
• Residential proxy rotation: the operator sent attack traffic through 31 exit IPs across 16 autonomous system numbers (ASNs) in one session. All 31 are Thordata exits: each returns Thordata’s documented x-thor-error-code header on port 6666.⁸ Internet scan data on 31 October 2026 showed about 273,000 hosts with that header, which is the size of the pool the operator can draw on. None of the 31 has an AlienVault OTX pulse.
• Three more hosts in the same network: they expose ARTEX consoles or the same nginx login on port 8787 or 8080. Nothing ties them to this operator beyond the hosting network and the tooling. They are watch-only, listed in watch-ips.csv and the indicator appendix.

Why it matters

One operator has assembled several AI agents into a toolkit. The suite is built so that a vulnerability workbench finds and proves flaws, ARTEX drives exploitation, a general agent handles glue work and a reverse-engineering console takes apart recovered binaries. Profero saw the exploitation stage against the targets. The other components were observed on the operator’s hosts, not in use against them. Each stage runs at machine speed, faster than playbook automation can follow, and the operator can run many targets in parallel.

The payloads do not match known tool signatures. The SQL injection Profero observed used stacked statements in a GET parameter, request paths carrying custom zz and nr markers, and data exfiltration in base64 chunks of about 1,800 bytes. Profero has not found this pattern in any public tool and assesses that it is an LLM agent improvising with a generic HTTP tool. Detections keyed to sqlmap, ARTEX default user agents or fixed payload strings will miss it. Generic injection rules, an origin lockdown and behavioral hunting are far more likely to catch it.

Block now

Import the Block Now list (block-ips.csv and block-domains.csv) into your firewall and WAF today. Both files hold one indicator per row for direct import; block-now-details.csv adds the role, confidence and first and last seen for each. Block the listed IPs only, never all of 156.240.236[.]0/24: unrelated tenants share that range. Tier numbers below map to the confidence column in the CSV files.

WAF and edge guidance

Two rules apply to every platform. First, test rules that can block real users (ASN challenges, managed rulesets, origin lockdown) in log or simulate mode before enforcing them. Second, when your WAF sits behind another proxy or content delivery network (CDN), match on the client IP header that your own proxy appends and trust no other, because attackers can spoof it.

The guidance below is written for any WAF, CDN or edge platform. Each item maps to a standard feature. Use your platform’s equivalent:

• Block list: import block-ips.csv as an IP list or address set and reference it from a block rule placed above every other rule. Use /32 entries. Block the three domains by name at DNS and the web gateway.
• Probe paths: add a rule that blocks requests whose path contains /artex-, whose path starts with /zz, or whose path is /nr with a query string that starts with zz. Do not block a bare /nr prefix: it matches legitimate routes.
• Challenge proxy traffic on login and admin paths: where the platform offers an interactive or managed challenge, apply it to the 14 proxy ASNs in proxy-exit-ips.csv on login, admin and account paths. Run it in log mode first. Exclude API, webhook and mobile-app paths, because machine clients cannot solve a challenge. Residential exits sit inside consumer ISPs (AS9304 is HGC, a major Hong Kong carrier), so some real users will see the challenge. That is the trade-off. Leave out the transit carriers in the pool (AS174 and AS3257).
• Lock the origin: allow only your edge provider’s published ranges to reach the origin, or enable mutual TLS between edge and origin with a certificate issued for your zone alone (a provider-wide shared certificate lets any customer of that provider reach you). Before enforcing, inventory direct callers: health checks, monitoring, partners and deployment pipelines. Without a lockdown, an attacker who finds the origin IP bypasses every rule above.
• Managed rules: run the platform’s core and SQL injection rulesets on the application’s hostnames in log or count mode first, then switch them to block. Add a rate limit on login, admin and search paths.
• Perimeter firewall: create an address group of /32 objects and deny it in both directions with logging. Outbound hits matter: they can mean an implant, or a staff member reaching the operator’s consoles or SOCKS relay (ports in Hunting).

Why IP blocking alone fails. The operator draws on a pool of about 273,000 residential exits, and those addresses also carry legitimate traffic. Blocking the 31 we saw buys minutes. What holds is an origin that accepts traffic only from your edge, plus challenges on login and admin paths for proxy ASNs, rate limits, and injection rules that do not depend on the source IP.

Generic SQL injection rules. Because the payloads are improvised, rely on generic detection. Run managed SQL injection rulesets in blocking mode, at a higher paranoia level on sensitive endpoints. Inspect the query string and body after URL and base64 decoding. Add rules for the keywords EXEC, DECLARE and WAITFOR inside parameters (T-SQL stacks statements without a semicolon) and for error-based probing. Then fix the root cause: parameterized queries, a least-privilege database account for the application, and OS command execution disabled in the database (for example xp_cmdshell on SQL Server).

Hunting

Search from 1 August 2026 (the first Cairn and CyberStrikeAI activity) to today. The first table is for your security operations center (SOC) and covers your own WAF, CDN, web server, proxy, DNS and database audit logs. The second is for a threat intelligence team with access to internet-scan platforms, TLS inspection or Zeek x509 and ssh logs. hunting-indicators.csv holds all 30 hunting indicators with where to look for each.

What a hit looks like. A source IP from the block list, or a proxy exit, requesting paths that match /artex-, ^/zz or ^/nr\?zz, or sending a GET parameter that matches (?i)\b(exec|declare|waitfor)\b after decoding. Exfiltration shows as repeated responses or error messages of about 1,800 bytes of base64. If you find one: pull database audit logs for the same window, check for new administrative accounts and web shells on the web tier, review endpoint detection and response (EDR) telemetry on the web servers, and contact Profero IRT before you remediate.

For your SOC:

For threat intelligence and scan platforms:

Attribution note

Profero assesses that this is a Chinese-speaking operator iterating through AI attack frameworks: CyberStrikeAI in August and September, the “Ultra” suite from October, with ARTEX alongside and a Cairn deployment in the same range. The basis is the language of the consoles, the Chinese model providers in the Cairn presets and the Hong Kong hosting.

Profero found no link to the actor named in public ARTEX reporting. The infrastructure shares no IPs, ASNs, certificates or providers with the published indicators, and its ARTEX probe markers use a different format. ARTEX is public code, so shared tooling says nothing about who runs it. Profero cannot rule out a link. It has found no evidence for one.

Indicator appendix

Indicators below are defanged. The CSV files are not, so they import directly: handle them as live. First and last seen are passive observation dates (scan data, certificate transparency, DNS), not attack times.

Downloads

Download the import-ready files:

• block-ips.csv: 63 Block Now IP addresses (Tier 1 and Tier 2), one per row for direct import
• block-domains.csv: 3 Block Now domains (Tier 1), one per row for direct import
• block-now-details.csv: the same 66 Block Now indicators with type, confidence, first and last seen, role and recommended action
• watch-ips.csv: 3 watch-only hosts in AS399077 (Tier 3)
• proxy-exit-ips.csv: 31 Thordata proxy exits used by the operator (Tier 3)
• hunting-indicators.csv: 30 hunting indicators with where to look

Block-now indicators

Watch-only indicators

References