ARTEX: Open-Source Agentic Pentest Framework Used in Attacks

ARTEX is an open-source, multi-agent AI penetration testing framework that has moved from lab tooling to active intrusion infrastructure. Security vendors have tied it to campaigns against financial institutions, Microsoft 365 tenants, government ministries, telecommunications providers, and defense and semiconductor companies. The original repository was taken private in October 2026. Copies, forks, and commercial variants remain in circulation.

That gap between a withdrawn project and a persistent capability is the important part. ARTEX is not a malware family with a fixed signature. It is an orchestration layer that turns a general-purpose language model and a set of legitimate security tools into an autonomous operator. Closing the source did not remove the architecture, and the architecture is what defenders now have to detect.

What ARTEX Actually Is

ARTEX is a harness, not a model. It accepts a target and an objective, then uses a planner agent to break the work into intents. Worker agents execute those intents with tools such as nmap, Impacket, bash, curl, and raw web requests. Results feed two graphs:

an asset graph of domains, services, endpoints, and applications
an exploration graph of goals, facts, findings, and hints

The system loops until the objective is met or an operator intervenes. Because the model layer is replaceable, ARTEX runs on any OpenAI-compatible endpoint, including Claude, GPT, DeepSeek, GLM, and Grok. Deployment is typically Docker Compose with a Go backend, a Next.js frontend, and PostgreSQL. The web console ships with English, Korean, Mandarin, Spanish, and Japanese interfaces.

Early releases included approval gates and traffic recording. Observed attacker instances often disable or bypass those restrictive checks. That detail matters for defenders who assume an agentic tool will stop at a safety boundary. In AhnLab testing, the system achieved web shell execution and internal lateral movement from a single high-level prompt against vulnerable lab targets.

Origin and Closure

ARTEX was released in July 2026 by Chinese security engineer Li Puhua (GitHub: Autumn-27), formerly a threat detection engineer at Threatbook. It was published under AGPL-3.0 as a personal project for authorized testing and research, and it won a Baidu Agent+ offense-defense challenge. The repository accumulated significant stars and forks before removal.

On 8 October 2026, the developer posted that the tool had been abused, that updates and public releases would stop, and that the project would become closed-source. The statement emphasized the original intent of authorized risk testing, disclaimed responsibility for illegal use, and condemned unauthorized activity. Pre-closure copies and community forks remain functional. Reporting also references a commercial edition and related offerings, including references to ARTEX PRO.

The Campaigns

Three clusters dominate public reporting. They differ in targeting and tradecraft, but share the same underlying pattern: agentic orchestration handling reconnaissance and repetitive exploitation, with human operators making decisions at key points.

Campaign	Timeframe	Targets	Notable detail
South Korean financial institutions	Late September to early October 2026	Banks, brokers, finance firms	CrowdStrike linked a likely Chinese-speaking, financially motivated operator using DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6
Storm-0940	From September 2026	Microsoft 365 tenants via ConnectWise Cloud Backup	Attempted sign-ins to more than 2,250 tenants; password spray against 327 accounts
Vapor Panda	From 17 October 2026	Government, defense, semiconductor, pharmaceutical, nuclear, finance, telecom	More than 200 organizations in at least 14 countries over an 11-day window

South Korean financial institutions

CrowdStrike identified an operator using ARTEX primarily with DeepSeek v4.1-flash, supplemented by GLM-5.3 and Grok 4.6. The actor targeted peripheral systems rather than core banking platforms: loan-inquiry services used by brokers and employee mobile work portals. Exposed infrastructure contained Claude Code session logs and ARTEX configuration files.

Reported data exposure ranges from roughly 67,000 to 100,000 records across multiple banks and finance firms, including names, phone numbers, income details, and limited card data. One bank disclosed approximately 25,000 affected customers. Seoul authorities investigated, and later reporting indicated arrests linked to AI-assisted intrusions against Korean companies.

Storm-0940 and the ConnectWise supply-chain compromise

Microsoft attributes activity by the China-aligned group Storm-0940, active since at least 2021, to ARTEX-assisted operations against hundreds of organizations. After compromising ConnectWise Cloud Backup (formerly SkyKick) multi-tenant application credentials, the group attempted sign-ins to more than 2,250 Microsoft 365 tenants.

A password-spray campaign against 327 accounts across eight organizations produced more than 151,000 failed logons, peaking at 2,900 failures per minute. Compromised application identities enabled Graph reconnaissance, credential additions, and privilege changes without interactive user authentication. In multiple cases, the time from initial targeting to privileged cloud access was under three hours. Microsoft stated the activity did not stem from flaws in its own products.

Vapor Panda

CrowdStrike tracks a separate China-nexus group, Vapor Panda, using ARTEX against more than 200 organizations across at least 14 countries in an 11-day window. Targets included government ministries in Latin America, the Middle East, and Europe; U.S. semiconductor, defense, pharmaceutical, nuclear, and financial entities; and telecommunications providers in the United States, Belgium, and the Philippines.

Confirmed post-exploitation occurred at a minimum of nine organizations, where the group deployed the BLOODALCHEMY backdoor, performed credential spraying, and conducted network scanning. Planning agents consumed roughly 1.4 billion input tokens in a single intrusion. Operators issued instructions in Mandarin at decision points. CrowdStrike describes this campaign as distinct from the Storm-0940 activity.

Additional observations

Other reporting adds ARTEX use against Japanese companies in insurance, finance, e-commerce, and logistics; exposed operator workspaces containing web shells, credential collection scripts, and implants; and AhnLab tracking of hundreds of internet-exposed ARTEX instances alongside related AI tooling. Google Threat Intelligence and Mandiant have also reported ARTEX in Active Directory environments for Kerberoasting and lateral movement.

Why Closing the Repository Did Not Work

The original code is no longer the bottleneck. Forks, cached copies, and commercial variants preserve the capability, and the design is reproducible by anyone who understands the pattern. ARTEX lowers the skill and time required to chain familiar techniques at high volume:

password spraying
OAuth application abuse
web application exploitation
internal enumeration and lateral movement

Observed operations combine agentic orchestration with human oversight at decision points. That produces both speed, with reports of hundreds to thousands of actions per hour, and parallel targeting across many victims. It also produces a distinctive operational rhythm: long idle periods, then dense command or API activity as the planner works through a queue of intents.

Similar multi-agent frameworks continue to appear. Organizations that treat ARTEX as an isolated case will encounter equivalent tooling under different names.

Detection: Look for the Workflow, Not the Name

Agentic workflows leave observable traces even when the specific tool name changes. The most useful detections correlate unusual tool execution with authentication and cloud-control-plane behavior rather than relying on a file hash or a process name.

MITRE ATT&CK mapping

Tactic	Technique	ID	Observed behavior
Reconnaissance	Active Scanning	T1595	High-volume or bursty `nmap`, `curl`, and sequential web requests
Initial Access	Exploit Public-Facing Application	T1190	Peripheral portals, loan-inquiry services, mobile work portals
Initial Access	Valid Accounts	T1078	Compromised application identities and partner credentials
Credential Access	Brute Force: Password Spraying	T1110.003	151,000+ failed logons; peaks near 2,900 per minute
Credential Access	Steal or Forge Kerberos Tickets: Kerberoasting	T1558.003	Active Directory service-ticket requests
Discovery	Network Service Discovery	T1046	Internal scanning after initial access
Discovery	Cloud Infrastructure Discovery	T1580	Graph reconnaissance against Microsoft 365
Persistence / Privilege Escalation	Account Manipulation: Additional Cloud Credentials	T1098.001	Credential additions and privilege changes on OAuth apps
Lateral Movement	Use Alternate Authentication Material	T1550	Application-only access without interactive user sign-in
Collection	Automated Collection	T1119	Scripted collection of records and credentials
Command and Control	Application Layer Protocol	T1071	LLM API traffic and tool callbacks from unexpected infrastructure
Defense Evasion	Impair Defenses	T1562	Disabling approval gates and skipping protected hosts

High-value hunts

Tool execution correlated with authentication anomalies. Look for nmap, Impacket, or bursts of sequential web requests from hosts or service accounts that normally do not run them, especially alongside failed or successful sign-ins.
Rapid progression from external reconnaissance to privileged access. Time-to-privilege is the signal. A perimeter scan followed by a cloud role assignment or OAuth credential addition within hours should escalate automatically.
Application-only sign-ins and credential changes. Audit OAuth and multi-tenant applications for new secrets, certificates, redirect URIs, and permission grants that have no corresponding user activity.
Idle-then-burst patterns. Agentic planners tend to think, then act hard. Baseline command and API volume per host, then alert on dense clusters after quiet periods.
Token consumption and LLM API traffic. Spikes from infrastructure that does not normally call model endpoints may indicate an AI agent operating inside the environment or an operator workspace exposed to the internet.
Exposed ARTEX instances. AhnLab has tracked hundreds of internet-exposed ARTEX deployments. Internet scanning for the console and its distinctive paths is a low-cost way to find operator infrastructure and, potentially, compromised hosts running the framework.

Hardening Priorities

The controls that matter are the ones that break the chain between recon and privileged access.

Inventory every internet-facing and partner-facing application. Include forgotten portals, broker systems, employee mobile gateways, and any multi-tenant application with delegated permissions.
Enforce MFA and disable legacy authentication. Password spraying only works when a valid password is sufficient. Application identities need their own credential hygiene, not just user MFA.
Audit third-party application permissions and credentials in Entra ID and equivalent platforms. Review consent grants, service principals, secrets, certificates, and any app with tenant-wide access.
Apply least privilege to multi-tenant apps. ConnectWise-style supply-chain access turns one compromised integration into thousands of potential tenant sign-ins. Restrict which tenants and operations each integration can reach.
Retain authentication, Graph, and endpoint logs for at least 90 days. An intrusion that moves from targeting to privileged access in under three hours can still be reconstructed if the telemetry survives long enough to review.
Cover unprotected hosts. Operators have directed agents to skip protected systems. Endpoint detection on the remaining estate is still the difference between visibility and blind spots.
Monitor AI infrastructure as production infrastructure. Model endpoints, agent workspaces, and API keys deserve the same logging, scoping, and egress controls as any other privileged service.

Bottom Line

ARTEX demonstrates that agentic offensive frameworks have moved from research and lab use into production campaigns by both financially motivated actors and China-aligned groups. The tool's code is no longer public. Its architecture is, and copies remain in the wild.

Defenders should treat automated, multi-step intrusion orchestration as an established technique rather than a future risk. The practical question is not whether an adversary is using ARTEX. It is whether the environment can distinguish a human operating a keyboard from a planner and a swarm of workers doing the same work faster.

ARTEX: The Open-Source Agentic Pentest Framework Driving Live Intrusions