ARTEX AI Pentest Tool: What Security Teams Need to Know
ARTEX AI has moved from a GitHub research project to the engine behind some of the fastest-moving agentic AI cyberattacks of 2026. ARTEX is an autonomous penetration testing framework that uses coordinated Large Language Model (LLM) agents to run reconnaissance, exploitation, privilege escalation and data theft with little human input.
Within weeks of its first confirmed malicious use against South Korean banks, ARTEX surfaced in a Microsoft 365 supply chain operation attributed to the China-state-aligned Storm-0940 and in a global espionage push by Vapor Panda that touched more than 200 organizations. This article covers what the tool is, who is using it, how the attacks unfold, and what defenders can hunt for today.
Key Takeaways
- Dual-use tool turned weapon: ARTEX AI is a China-developed, LLM-driven multi-agent penetration testing framework that several unrelated threat clusters have used in real intrusions since late August 2026.
- Largest campaign to date: CrowdStrike reports that the China-nexus group Vapor Panda ran one ARTEX controller against more than 200 organizations in at least 14 countries over 11 days starting October 17, 2026, with confirmed post-exploitation at nine.
- Supply chain fallout: Microsoft ties ARTEX to Storm-0940, which abused ConnectWise Cloud Backup application credentials against more than 2,250 Microsoft 365 tenants, while Wiz saw related activity spread to IT and software vendors.
- Incidents keep surfacing: In just four weeks, ARTEX was linked to breaches at South Korean banks, about 20 Japanese companies, a Korean criminal ring that stole 8.2 million records and, most recently, WorkOS.
- No patch, only hardening: ARTEX exploits weak identity hygiene and exposed services, so defense rests on credential rotation, least-privilege app access and hunting for its behavioral traces.
ARTEX AI at a Glance
| Attribute | Details |
|---|---|
| Tool Type | LLM-based multi-agent autonomous penetration testing framework (written in Go) |
| Developer | GitHub user Autumn-27, China |
| Source Status | Open source until October 8, 2026; now closed source, but forks remain public |
| LLM Backends Observed | DeepSeek v4.1-flash (primary in the South Korea case), GLM-5.3 (Zhipu AI), Grok 4.6, plus an unidentified commercial model (Vapor Panda) |
| CVE ID | None; ARTEX is an offensive tool, not a vulnerability |
| Known Operators | Vapor Panda (CrowdStrike), Storm-0940 (Microsoft), an unattributed Chinese-speaking actor tracked by Recorded Future as TAG-217, a South Korean criminal ring |
| Exploitation Status | Actively used in the wild since at least late August 2026 |
| Patch Available | Not applicable; mitigation relies on hardening and detection |
| Discovered By | CrowdStrike, Microsoft Threat Intelligence, Google Threat Intelligence Group and Mandiant, Wiz, Recorded Future Insikt Group, GMO Cybersecurity by Ierae, Theori |
At the time of this blog post, no vendor has published evidence linking the four operator clusters to one another beyond shared use of the tool.
ARTEX AI Explained: An Autonomous Penetration Testing Framework
ARTEX is a multi-agent offensive security framework written in Go and published on GitHub in July 2026 by a Chinese developer using the handle Autumn-27. The project was pitched for learning, research and testing authorized assets. Its design lets one operator hand an objective to a team of AI agents and let them work through an entire kill chain.
The framework spread quickly because it lowers the skill and staffing an intrusion requires. Classic automation replays fixed scripts, while ARTEX agents read each result, decide the next move and keep going, so a single controller can run parallel intrusions against hundreds of targets. As models get cheaper and more capable, the number of attacks a group can launch depends less on headcount and more on compute.
ARTEX is not the only framework crossing that line. Cairn, another open-source agent platform, was tied in October 2026 to an actor that targeted the websites of more than 100 companies.
Independent infrastructure counts point the same way. AhnLab reported ARTEX instances on about 600 IP addresses on October 6, 2026, and a researcher has since mapped more than 3,600. When those addresses were checked against another internet threat intelligence service, about 89% had never been seen scanning the internet, and fewer than 3% were classified as malicious or suspicious, so most ARTEX servers stay quiet rather than spraying the internet themselves.
How ARTEX Agents Run an Intrusion
ARTEX splits an attack into stages handled by cooperating agents:
- Planning: An operator sets a goal, and planning agents map the target and decide the next step.
- Execution: Worker agents run scanners, exploit known weaknesses, drop web shells and harvest credentials.
- Feedback: Results flow back to the planners, which adjust the plan and launch the next wave.
- Expansion: The loop repeats through lateral movement and data collection, often across thousands of actions per session.
Google Threat Intelligence Group and Mandiant describe ARTEX splitting work across six sub-agents, and observed one burst of 27 events in 23 seconds, a tempo no human operator produces.
AI Models Behind ARTEX
ARTEX is model-agnostic and plugs into any LLM API. In the South Korean bank intrusions, CrowdStrike found DeepSeek v4.1-flash as the main backend, likely reached through the reseller xcai[.]pro, with GLM-5.3 (Zhipu AI) and Grok 4.6 supporting additional Claude Code sessions. Vapor Panda relied mainly on DeepSeek plus a second, subscription-based commercial model that CrowdStrike could not identify.
Timeline of Recent ARTEX AI Attacks and Disclosures
ARTEX went from first confirmed abuse to a dozen public disclosures in under a month. As of November 4, 2026, these are the milestones defenders should know.
| Date | Development |
|---|---|
| November 2, 2026 | WorkOS discloses unauthorized access, detected October 30, to an internal sales and marketing API; its CEO names ARTEX on X |
| October 30, 2026 | Google and Mandiant detail ARTEX in Active Directory intrusions, from Kerberoasting to DCSync |
| October 29, 2026 | Vapor Panda report: one ARTEX controller, 200+ targeted organizations, at least 14 countries, nine confirmed compromises |
| October 26, 2026 | Seoul police reveal a seven-person ring that targeted 90+ Korean organizations with ARTEX and stole 8.2 million records |
| October 22, 2026 | ARTEX-linked activity overlapping Storm-0940 expands to IT and software vendors through Okta, Entra and Cognito |
| October 21, 2026 | ConnectWise Cloud Backup supply chain compromise attributed to the China-state-aligned Storm-0940 using ARTEX |
| October 19, 2026 | ARTEX linked to attacks on about 20 Japanese companies from infrastructure aimed almost exclusively at Japan |
| October 17, 2026 | ConnectWise disables seven Cloud Backup application identities; the Vapor Panda campaign begins |
| October 16, 2026 | Preparation activity since August 2026 tied to a cluster tracked as TAG-217 |
| October 15, 2026 | ARTEX white paper and free detection rules published |
| October 8, 2026 | Developer halts updates and converts ARTEX to closed source, citing misuse |
| October 7, 2026 | First report of ARTEX used against South Korean financial firms |
| July 2026 | ARTEX published as open source on GitHub |
Vapor Panda’s ARTEX Campaign Against 200+ Organizations
Vapor Panda, a China-nexus group, delivered the largest ARTEX operation on record. Starting October 17, 2026, a single ARTEX controller targeted more than 200 organizations in at least 14 countries over 11 days. CrowdStrike confirmed post-exploitation at nine victims, documenting the BLOODALCHEMY backdoor at a Middle East interior ministry and a Latin American foreign ministry, and password spraying or credential scanning against at least 12 more.
The operator issued instructions in Chinese, while the agents ran mostly on DeepSeek. In one intrusion alone, the planning agents consumed roughly 1.4 billion input tokens.
Who Vapor Panda Targeted
- Government: Ministries in Latin America, Europe, Asia and the Middle East, including a compromised Middle East interior ministry, plus a Greek government entity.
- Telecommunications: Providers in the United States, Belgium and the Philippines.
- Industry and research: US defense contractors, semiconductor and pharmaceutical firms, financial institutions, nuclear sector organizations and think tanks.
How the Agents Broke In
Vapor Panda’s agents leaned on weak identity plumbing. At one US pharmaceutical firm, they chained an unsigned SAML assertion with an XML external entity (XXE) flaw to query the cloud metadata service. At a second, they used web shells, LAPS password retrieval and resource-based constrained delegation. At the Greek government entity, unrotated keys from a 2022 mail server export, supplied by the operator, let the agents forge admin tokens.
Storm-0940 and the ConnectWise Cloud Backup Supply Chain Attack
Microsoft attributes the ConnectWise Cloud Backup compromise to Storm-0940, a China-state-aligned actor active since 2021 that began using ARTEX by at least September 2026. The group used stolen credentials for ConnectWise Cloud Backup (formerly SkyKick) application identities, which already held consented permissions inside customer Microsoft 365 tenants, so no interactive user sign-in was needed.
With ARTEX automating the work, Storm-0940 attempted sign-ins across more than 2,250 tenants, with failures peaking at 2,900 per minute. In multiple cases, Microsoft says the actor went from initial targeting to privileged cloud access in under three hours. Targeted sectors included government, aerospace, defense, finance, manufacturing, technology, energy, semiconductors and think tanks.
ConnectWise disabled seven affected application identities on October 17, 2026, and has since begun a phased restoration through a new ConnectWise Cloud Backup for M365 application.
Expansion to IT and Software Vendors
Wiz reported on October 22, 2026 that ARTEX-linked activity overlapping Storm-0940 had spread to multiple IT and software vendors throughout October. The agents sprayed hundreds of accounts, mostly belonging to software engineers, at one-second intervals and probed identity providers including Okta, Entra and Cognito to reach the vendors’ customer data. Most attempts failed, yet the pattern signals a broader supply chain strategy.
WorkOS Confirms an ARTEX-Linked Breach
The most recent victim to go public is identity platform WorkOS. The company said it identified unauthorized access on October 30, 2026 to an internal application used by its sales team, exposing business contact details, account and relationship information, and summaries and excerpts from sales calls, support discussions and customer Slack conversations. In a November 2, 2026 post on X, founder and CEO Michael Grinich said the attack involved ARTEX. WorkOS says no app data or production services were accessed or affected.
ARTEX Attacks in South Korea and Japan
East Asia saw the first and most numerous financially motivated ARTEX intrusions, from bank data theft to extortion of academies and hospitals.
South Korean Banks
In late September and early October 2026, an unidentified actor used ARTEX to steal customer data from auxiliary systems at South Korean lenders, including Shinhan Bank, KB Kookmin Bank and Hana Bank, which initially confirmed about 25,000, 119 and 89 affected customers respectively. CrowdStrike assesses with moderate confidence that the actor is Chinese-speaking and financially motivated. The operation came to light through open directories exposing ARTEX configuration files and Claude Code session histories. Hana said no financial transaction data leaked, and KB said the breached system was unrelated to customer financial transactions.
Recorded Future’s Insikt Group links the attacks to a cluster it tracks as TAG-217, whose preparation dates back to as early as August 2026.
The Seoul Criminal Ring
On October 26, 2026, the Seoul Metropolitan Police Agency revealed a seven-person ring that targeted more than 90 Korean organizations and breached about 60, stealing an estimated 8.2 million records. Victims included private academies, universities, hospitals, large corporations and golf courses, and the group demanded a combined 360 million won (about $270,000) in 38 incidents. The leader, a 32-year-old former penetration tester, was referred to prosecutors on October 23, 2026.
Japanese Companies
GMO Cybersecurity by Ierae disclosed on October 19, 2026 that ARTEX was used in many recent attacks on Japanese firms, linking it to about 20 companies, nine of them in the same industry. The activity ran from six AI-enabled servers on infrastructure aimed almost exclusively at Japan, and it is the same tool used in the earlier South Korean bank breaches, though no link between the operators has been shown. GMO has shared its findings with law enforcement.
ARTEX Tactics, MITRE ATT&CK Mapping and IOCs
ARTEX intrusions lean heavily on credential and identity abuse. Google and Mandiant incident responders saw agents pull more than 110,000 Active Directory objects in one case, and used Kerberoasting and DCSync to take the krbtgt key, cloud sync credentials and domain controller hashes. In the campaign overlapping Storm-0940, the jump from a first compromised account to deep access took about four hours, and in one case just 15 minutes. Command output was exfiltrated through 491 rotating webhook.site URLs. Forks such as ScopeWeaver and a paid ARTEX PRO edition keep the code in circulation.
MITRE ATT&CK Techniques
SOCRadar mapped the behaviors reported by CrowdStrike, Microsoft, Wiz and Google to ATT&CK; the vendors’ own reports may use different groupings.
| Tactic | Technique | ID | Observed Behavior |
|---|---|---|---|
| Initial Access | Exploit Public-Facing Application | T1190 | XXE and web application flaws on exposed services |
| Initial Access, Persistence | Valid Accounts: Cloud Accounts | T1078.004 | Abuse of consented ConnectWise application identities |
| Credential Access | Brute Force: Password Spraying | T1110.003 | Spray waves against Microsoft 365 and identity provider accounts |
| Credential Access | Unsecured Credentials: Cloud Instance Metadata API | T1552.005 | SAML and XXE chain used to query the cloud metadata service |
| Credential Access | Forge Web Credentials | T1606 | Admin tokens forged with unrotated mail server keys |
| Credential Access | Steal or Forge Kerberos Tickets: Kerberoasting | T1558.003 | Service ticket requests against Active Directory |
| Credential Access | OS Credential Dumping: DCSync | T1003.006 | Replication of krbtgt and domain controller hashes |
| Persistence | Server Software Component: Web Shell | T1505.003 | Agent-written JSP web shells on compromised servers |
| Persistence | Account Manipulation: Additional Cloud Credentials | T1098.001 | New credentials added to application identities |
| Privilege Escalation | Account Manipulation: Additional Cloud Roles | T1098.003 | Changes to privileged roles and groups |
| Exfiltration | Exfiltration Over Web Service: Exfiltration Over Webhook | T1567.004 | Command output sent to rotating webhook.site URLs |
Known ARTEX Indicators of Compromise
Validate these indicators in hunts before adding them to blocklists, since infrastructure rotates quickly and some addresses sit on shared hosting.
| Indicator | Type | Campaign |
|---|---|---|
| 144.172.64[.]128 | IPv4, primary vector for vendor-credential app sign-ins (Huntress) | Storm-0940 |
| 144.172.64[.]60 | IPv4, failed user logins on October 18 (Huntress) | Storm-0940 |
| 144.172.64[.]99 | IPv4, password spray October 10 to 14 (cited by Microsoft) | Storm-0940 |
| nginxmysql[.]com / 45.153.126[.]223 | C2 domain / IPv4 | Vapor Panda |
| sqlserver-sqlite[.]com / 89.46.234[.]50 | C2 domain / IPv4 | Vapor Panda |
| www[.]ddduuuppp[.]com / 192.121.47[.]20 | C2 domain / IPv4 | Vapor Panda |
| 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068 | SHA-256, renamed GameHook executable (svchost.exe) | Vapor Panda / BLOODALCHEMY |
| 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4 | SHA-256, graphics-hook-filter64.dll | Vapor Panda / BLOODALCHEMY |
| 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab | SHA-256, graphics-hook_config.bin | Vapor Panda / BLOODALCHEMY |
| C:\ProgramData\artx5v\ | Directory artifact | Vapor Panda |
| D:\ProjectX\Merman_New\ | Implant path artifact | Vapor Panda |
| 38.244.50[.]120 (port 18899) | IPv4, ARTEX instance host | South Korean bank attacks |
| cl1217.jsp, f1219a.jsp, z1219.jsp | Web shell file names | Google/Mandiant cases |
| artex-probe-* / ArtexProbe | File name pattern / account name | Google/Mandiant cases |
How to Detect ARTEX Activity
Behavior gives ARTEX away faster than any single indicator. Agents act at machine speed and repeat themselves, so tune detections for tempo and pattern:
- Machine-paced sign-in bursts: Password spray attempts spaced exactly one second apart, waves lasting 20 to 60 minutes and dozens of SSO route variations in a few minutes.
- Rapid-fire cloud enumeration: Dozens of permission or directory queries within seconds, such as the 27 events in 23 seconds Google observed.
- Service principal anomalies: Sign-ins by vendor application identities from unfamiliar IPs, new credentials on those apps and sudden privileged role assignments.
- Host and cloud artifacts: The C:\ProgramData\artx5v\ directory, command-line parameters containing “artx” or “artex”, cloud roles with an “artx” prefix, admin command comments prefixed “art18-“ and files matching artex-probe-*.
- Outbound webhook traffic: Repeated requests from servers to webhook.site or similar request-capture services.
Theori has released free Sigma, Suricata, YARA and ModSecurity rules built from ARTEX activity, a practical starting point for SIEM and IDS coverage. Treat artifact strings as leads that warrant investigation, since a tool name alone does not prove which actor is behind an intrusion.
Mitigation and Recommendations
ARTEX rewards attackers for finding the weaknesses defenders have postponed fixing, so the strongest response is closing identity and exposure gaps before the agents arrive.
- Audit third-party application identities: Inventory every multitenant app holding consent in Entra ID, remove unused ones, trim permissions to least privilege and alert on new credentials, owners or role assignments for service principals.
- Rotate long-lived keys and certificates: Replace mail server signing keys, SAML signing certificates and API secrets that have not rotated in over a year, and reject unsigned SAML assertions at every identity provider.
- Shut off metadata and XML abuse paths: Enforce IMDSv2 on AWS workloads, restrict metadata endpoints on other clouds and disable external entity processing in XML parsers to break SAML and XXE chains.
- Blunt password spraying: Require phishing-resistant MFA, enable smart lockout, block legacy authentication through Conditional Access and alert on failure bursts from a single ASN or IP range.
- Patch and shrink the internet-facing surface: Prioritize flaws in the CISA Known Exploited Vulnerabilities catalog and pull management or container orchestration interfaces off the public internet.
- Protect Active Directory secrets: Limit read rights on LAPS password attributes and monitor changes to msDS-AllowedToActOnBehalfOfOtherIdentity, the attribute abused in resource-based constrained delegation.
- Deploy behavior-based detections: Load Theori’s ARTEX detection rules, hunt for the published indicators and tune alerts for machine-paced request sequences.
- Preserve evidence before cleanup: Export sign-in, audit and SIEM records before deleting apps or credentials, since removing them first can erase the trail investigators need.
How SOCRadar Can Help
SOCRadar’s Extended Threat Intelligence platform covers the exposure, identity and supply chain gaps that ARTEX agents probe first. These modules fit best:
- Attack Surface Management: Continuously discovers exposed services, misconfigured identity endpoints and unpatched internet-facing assets before ARTEX scanners find them.
- Vulnerability Intelligence: Prioritizes actively exploited flaws, so teams patch the weaknesses agents chain for initial access first.
- Cyber Threat Intelligence: Tracks Vapor Panda, Storm-0940 and related clusters, with actor profiles and fresh IOCs ready for SIEM and EDR hunting.
- Identity & Access Intelligence: Flags compromised employee and customer credentials that fuel password spraying and account takeover.
- Dark Web Monitoring: Alerts on leaked data and sale posts tied to your organization on Dark Web forums and Telegram channels.
- Supply Chain Intelligence: Monitors third-party providers such as backup and SaaS vendors for breaches before their access is turned against you.
Frequently Asked Questions About ARTEX AI
Is ARTEX AI Malware?
ARTEX AI is a dual-use offensive security framework, similar in purpose to commercial red team platforms, and is not malware by design. The danger lies in who runs it. Threat actors have paired ARTEX with stolen credentials and backdoors such as BLOODALCHEMY, turning an assessment tool into an engine for espionage and data extortion.
Is ARTEX Fully Autonomous?
ARTEX can run long attack sequences on its own, yet every documented campaign involved human direction. Vapor Panda’s operator issued instructions in Chinese, and Microsoft says the framework automated specific attack stages for Storm-0940 operators rather than planning entire operations alone. The agents supply speed and scale, while people still choose targets and goals.
Is ARTEX Still Available on GitHub?
The original ARTEX repository went closed source on October 8, 2026, when developer Autumn-27 halted updates and cited misuse, one day after CrowdStrike reported the South Korean bank attacks. Copies, English and Korean derivatives and forks such as ScopeWeaver remain in circulation, and a paid ARTEX PRO edition has appeared.
Is There a Patch for ARTEX AI?
No patch exists because ARTEX AI is an attack tool, and no CVE is assigned to it. The framework succeeds by abusing weaknesses already present: unrotated keys, unsigned SAML assertions, over-permissioned third-party apps and known vulnerabilities on internet-facing systems. Closing those gaps removes the footholds ARTEX agents hunt for.
What Should ConnectWise Cloud Backup Customers Do?
ConnectWise Cloud Backup customers should keep affected connections disabled until ConnectWise provides restoration steps, then search tenants by application ID rather than display name. ConnectWise and Huntress recommend reviewing activity from October 13, 2026, or from October 1 where retention allows, and checking for new app credentials, role changes and consent grants.
