ARTEX Unmasked | The Rise of AI-Powered ARTEX in Cybercrime & Espionage
Executive Summary
ARTEX is a Chinese open-source, AI-powered penetration testing platform designed to help security teams assess systems they own or are authorized to test. In recent weeks, it has been used in traditional cybercrime campaigns, including in attacks on South Korean banks. Although the original developer made ARTEX closed-source in mid-October, actively maintained forks and backups of the original repository remain publicly available to threat actors.
Nation-state actors swiftly adopted this new tool: a China-nexus espionage actor used ARTEX against more than 200 organizations in at least 14 countries. Another China-state aligned actor, who was responsible for the October 2026 ConnectWise supply chain compromise, used ARTEX to attempt mass sign-ins to more than 2,250 Azure tenants.
We assess with high confidence that ARTEX marks a change in the threat landscape: agentic offensive frameworks have moved from experiments to operational use by state-aligned and financially motivated actors alike. Since late August 2026, at least five actors and clusters have used ARTEX, from China-nexus espionage groups to a Cambodia-based criminal cluster. Closing the source in early October did not slow adoption.
The barrier to entry is low: Operators ran ARTEX in default configurations, and each campaign cost $145 to $1,500 in model time. The agents work at machine speed: in one case of suspected ARTEX use, an agent went from a leaked GitHub secret to Azure Key Vault data in five minutes. They can also be told to look for gaps, e.g. a Chinese-aligned actor told its agents to find Windows hosts without an EDR sensor.
We expect more actors to adopt ARTEX and similar frameworks such as PentAGI and Cairn. For defenders, the time between a leaked secret or an exposed flaw and its exploitation can now be minutes, and IP blocklists lose value against agents that rotate through residential proxies. Rotating secrets, closing internet-facing flaws, and EDR coverage on every host now matter more than simply blocking indicators.
Key Highlights
- A tool built for authorized testing now runs criminal campaigns. Across the 10 instances Check Point analyzed, operators used ARTEX exclusively for opportunistic, financially motivated cybercrime, mostly on a broad scale. The operators ran default configurations with default tools.
- State-linked actors use it, too. For instance, a China-nexus espionage actor, used ARTEX against more than 200 organizations from October 17, 2026. Its operator told the agents to find Windows hosts without an EDR sensor.
- A supply chain compromise fed ARTEX more than 2,250 targets. Storm-0940 gained control of the identities of multiple ConnectWise cloud applications, including Cloud Backup, and used ARTEX to attempt sign-ins to more than 2,250 tenants.
- The agents ran without an operator. In multiple campaigns, nobody prompted the agents after the operator set the initial task goals.
- The campaigns were cheap and the losses were real. Observed campaigns cost an estimated $700 to $1,500, recovering more than 300 signing certificates with their passwords or more than 190,000 Honor of Kings credentials, about 6,000 of them still valid, in exchange.
- From GitHub to Key Vault in 5 minutes. In at least one case of suspected ARTEX use, an AI agent moved from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes.
What Is ARTEX
ARTEX is an agentic AI penetration testing platform that, by default, uses off-the-shelf tools like Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, and headless Chromium, among others. Many operators routed their agents through residential proxies, and one operator built a custom skill for proxy use.
According to various reports, DeepSeek v4.1-flash was utilized as the primary model, with GLM-5.3 and Grok 4.6 used in additional Claude Code sessions. Models from the DeepSeek Flash family were the most prevalent across the 10 analyzed instances. Note that Operators configured American models on three instances and guardrails triggered only on Anthropic's Opus 5.5. As a consequence in this case, the actor then switched to more permissive Chinese models.
ARTEX at a Glance
Attribute | Detail |
|---|---|
Name | ARTEX |
Type | Agentic AI penetration testing platform |
Origin | Chinese, open-source until October 8, 2026 |
Availability | Maintained forks and backups of the original repository, including ScopeWeaver and ARTEX PRO |
Exposure | At least 2,500 systems hosting or having hosted ARTEX panels, 1,608 live and publicly available. 1,465 exposed consoles on November 3 and 4, 2026 |
Timeline
The following events list the most important milestones of this emerging threat:
Date (2026) | Event |
|---|---|
August | Threat actors begin querying public GitHub repositories for exposed secrets, suspected ARTEX use |
September | Storm-0940 begins using ARTEX to automate attacks |
October 7 | Threat actors use ARTEX in attacks on South Korean banks |
October 8 | The developer makes ARTEX closed-source |
Mid-October | Creation of new ARTEX C&C servers spikes, coinciding with prominent public reporting about the project |
October 17 | VAPOR PANDA begins ARTEX-enabled intrusions |
October 19 to November 4 | Storm-3358 actively using ARTEX |
October 21 | Microsoft attributes the supply chain compromise of a multi-tenant vendor application to Storm-0940 |
Exploitation in the Wild
Espionage and State-Linked Use
The China-nexus espionage actor VAPOR PANDA ran ARTEX-enabled intrusions for 11 days from October 17, 2026. The campaign targeted more than 200 organizations in at least 14 countries, with post-exploitation confirmed at nine. Targets included foreign ministries, a European presidency, and US pharmaceutical, semiconductor, defense, and nuclear organizations. The operator told the agents to find Windows hosts without an EDR sensor, judged from tasklist output and folder listings.
After access, the actor deployed BLOODALCHEMY through DLL sideloading by a renamed GameHook binary running as svchost.exe. CrowdStrike links the ARTEX controller to VAPOR PANDA infrastructure and distinguishes the campaign from Storm-0940.
Storm-0940, another China-state aligned actor, was responsible for the ConnectWise supply chain compromise. As early as September 2026, Storm-0940 used ARTEX to automate attacks, accelerate scanning and reconnaissance, and attempt sign-ins to more than 2,250 tenants.
Incident response engagements since late August 2026 found ARTEX in intrusions at US government, technology, chemicals, and manufacturing organizations. They found artex-probe files, numbered JSP web shells, and webhook.site callback URLs.
CERT-EU reports activity against EU institutions that "highly likely involved the use of ARTEX."
Criminal Campaigns
An analysis of three criminal campaigns using ARTEX found agents operated autonomously after initial goal-setting. These included Apple certificate theft across 10 signing shops, crypto-draining targeting payment infrastructure and TRON wallets, and harvesting over 190,000 gaming credentials. These operations demonstrated low financial barriers and high autonomy, with model costs ranging from $145 to $1,500.
State-linked actors and cybercriminals expanded usage beyond basic pentesting. For instance, VAPOR PANDA targeted over 200 organizations, Storm-0940 used access through a compromised vendor application to attempt sign-ins to more than 2,250 tenants, and Storm-3358 targeted Southeast Asian financial institutions, all using ARTEX.
Global intelligence advisories, including CERT-In and CERT-EU alerts, emphasize that agentic offensive tools like ARTEX, PentAGI, and Cairn represent a broader shift toward automated, machine-speed exploitation across both espionage and financial attacks.
Why This Matters
ARTEX now serves both espionage and financially motivated actors, enabling them to carry out their attacks at machine speed. The same framework ran intrusions against foreign ministries and defense organizations, sign-in attempts against more than 2,250 tenants, and criminal campaigns that stole signing certificates and gaming accounts. Seeing ARTEX in an intrusion no longer tells defenders who is behind it or what they want.
The skill and money needed to run a campaign have dropped. Operators ran ARTEX in default configurations, and each campaign cost $145 to $1,500 in model time. For less than $1,500, one operator came away with 3 validated signing certificates and their passwords, enough to sign apps that appear to come from the certificate owners.
Exposed weaknesses are found and used faster. The agents retry failed calls within seconds, and in one case of suspected ARTEX use, an agent got from a leaked GitHub secret to Azure Key Vault data in five minutes. A leaked key, an unauthenticated API, or an unpatched internet-facing application can now be found and exploited within minutes.
Trusted paths carry the risk further: one actor turned a compromised vendor application into a launch point against more than 2,250 tenants. One weak link at a vendor or in a delivery pipeline now exposes everyone downstream at machine speed.
Indicator-based defenses lose value against this kind of operator. The agents rotate through residential proxies, and one proxy service showed 79 exit IPs in 100 sampled identities. Behavior on the host and in the cloud stays the same when the addresses change, such as a web server that starts a shell or one app requesting tokens across several services. Coverage gaps are found just as fast: one actor told its agents to find Windows hosts without an EDR sensor.
Attack Chain
The campaigns in this report show the breadth of TTPs that operators run through ARTEX, an agentic penetration testing framework. The same tool served web application exploitation, cloud identity abuse, a vendor supply chain compromise, and espionage implants.
Stage 1: Initial Access
Agents enter through whatever an internet-facing system exposes. In the described criminal campaigns, they used hardcoded administrator passwords, plaintext credential files in the web root, weak administrative credentials, and unauthenticated web APIs. They also exploited IDOR, command injection, and SSTI flaws. A Cambodia-based financially motivated cluster used anonymous file upload and server-side request forgery. A China-state aligned actor abused a compromised multitenant vendor application to attempt sign-ins to more than 2,250 tenants. In the suspected ARTEX activity against cloud tenants, agents harvested secrets from public GitHub repositories.
Stage 2: Execution and Command and Control
Command injection and SSTI gave the agents code execution in web applications. Agents allegedly used a compromised OAuth application to run scripts on Azure VMs through Run Command against cloud tenants. The financially motivated cluster's agents used curl and netcat to fetch the WISP, vshell, and AdaptixC2 remote access tools. In attacks against South Korean financial services, operators staged a JNDI/LDAP exploitation rig, and incident responders in other intrusions found numbered JSP web shells and webhook.site callbacks.
Stage 3: Escalation, Discovery, and Evasion
On a Linux host, an agent escalated from a low-privileged user to root through overly permissive folder access. Operator infrastructure also held exploit builds whose file names reference CVE-2022-2588 and CVE-2025-5054. A China-nexus espionage actor told its agents to find Windows hosts without an EDR sensor, judged from tasklist output and folder listings. On the hosts it chose, it sideloaded the BLOODALCHEMY backdoor through a renamed GameHook binary running as svchost.exe. Operators routed agent traffic through residential proxies to rotate their source addresses.
Stage 4: Credential Harvesting
In the suspected ARTEX activity against cloud tenants, agents called Azure operations that return credentials, exfiltrated Key Vault data, and searched Azure DevOps for secrets. In one case, an agent went from a leaked GitHub secret to Key Vault data in five minutes. In AWS, agents searched CloudWatch logs with stolen long-term access keys and self-registered in public Cognito user pools. The criminal campaigns pulled AWS S3 keys from an unauthenticated API and found megabytes of plaintext credentials.
Stage 5: Collection and Monetization
In the suspected ARTEX activity against cloud tenants, agents downloaded SharePoint and OneDrive files and accessed mailbox items. The criminal agents collected more than 300 signing certificates with their passwords and about 6,000 valid gaming accounts, and wrote to an S3 bucket that served a crypto service's iOS apps.
Recommended Mitigations
Find and Rotate Exposed Secrets
- Search public GitHub repositories and Azure DevOps for material the agents queried for, such as credentials, application secrets, and AI inference API keys. Rotate every secret you find.
- Enable GitHub push protection so new secrets are blocked before they reach a repository.
Close Initial Access Paths
- Audit web APIs for responses that return cloud credentials, such as the AWS S3 keys an unauthenticated API leaked in one campaign.
- Disable anonymous file upload and fix server-side request forgery flaws on internet-facing systems.
- Put administrative interfaces behind a VPN.
Limit the Blast Radius
- Review which identities can read storage account keys, App Service settings and publishing credentials, connection strings, AI and ML connections and datastores, and AKS user credentials.
- Restrict who can use Run Command on Azure VMs.
- Restrict write access to S3 buckets that serve app manifests or landing pages.
- Move applications to managed identities where possible, and set app management policies that restrict new secrets and credentials.
- Apply least privilege to multi-tenant application permissions.
Watch for Failed Attempts
- Alert on Entra ID sign-in errors AADSTS7000215 (invalid secret) and AADSTS7000222 (expired secret). Either one means someone holds a credential for your app. Treat a failure followed by a success as urgent.
- Alert on one address authenticating to 3 or more service principals with mixed success, or one app requesting tokens across ARM, Key Vault, Storage, and Graph in a short window.
- Alert on a failed API call that is retried shortly after with a different API version, such as the Key Vault rerun about 28 seconds after the first failure.
- Alert on user agents that contain
artex, the strings Datadog observed in AWS activity.
Block the Indicators
Block the IP addresses and domains in Observed Indicators (Appendix) at the firewall and proxy, and add the SHA-256 hashes to your endpoint blocklist. Treat the Tor exit node, VPN, and proxy addresses as hunting leads rather than blocks, because other traffic shares them. Investigate any historical connection to the indicators.
How SentinelOne Protects Customers
The SentinelOne® agent records what an ARTEX agent does once it reaches a managed host. Behavioral AI detects the shell spawned by a compromised web application, the reconnaissance tools it runs, the escalation to root on a Linux host, and DLL sideloading on a Windows host. Singularity™ AI SIEM correlates Entra ID sign-ins, Azure activity logs, and AWS CloudTrail with that endpoint activity to surface stolen service principal credentials and cloud keys in use. Each step is a hunting point in Purple AI®.
Correlate Identity and Cloud Activity in Singularity AI SIEM
Forward Entra ID sign-in logs, Azure activity logs, Microsoft 365 audit logs, AWS CloudTrail, and web server and WAF logs to Singularity AI SIEM. It ties a failed-then-successful service principal sign-in to the Key Vault, Storage, and Graph token requests the same app makes in a short window. Singularity Identity flags the Entra ID accounts and service principals the actors misuse.
Self-Hosted Customers Should Ensure Known Malicious Hashes Are Blocked
The hunts below find the same activity whatever the hash. Self-hosted customers without cloud reputation services should block every SHA-256 hash in Observed Indicators.
Hunt with Purple AI
Use Purple AI to hunt for the identity and cloud activity described in this report. In Entra ID sign-in logs, Azure activity logs, and AWS CloudTrail forwarded to Singularity AI SIEM, look for service principals that fail with an expired or invalid secret and then sign in successfully, one address signing in to many service principals, unexpected activity by vendor applications such as the affected ConnectWise apps, and requests with artex in the user agent. Look back to August 1, 2026, when the earliest reported activity began.
Use Purple AI to hunt on the endpoint for what an ARTEX agent does after it gets in. On hosts with an active agent, look for web server processes that start a shell, command lines and file paths that contain artx or artex, DLL sideloading by binaries posing as system processes, and connections to the addresses and domains in Observed Indicators. Treat each match as a lead to investigate, because authorized penetration testers also run ARTEX.
Consider Engaging Wayfinder
Contact your SentinelOne account team to discuss engaging Wayfinder Threat Hunting.
Appendix
The following Indicators of Compromise have been publicly associated with malicious Artex campaigns.
Type | Indicator |
|---|---|
IP address | 199[.]19[.]77[.]84 (service principal sign-ins, suspected ARTEX use) |
IP address | 199[.]19[.]77[.]18 (service principal sign-ins, Tor exit node that might be associated with unrelated malicious activity) |
IP address | 65[.]87[.]223[.]26 (shell commands in user agents, App Service token attempts) |
IP address | 157[.]22[.]126[.]128 (reconnaissance against Azure AI workloads) |
Behavior | One address authenticating to 3 or more service principals with mixed success, or one app requesting tokens across ARM, Key Vault, Storage, and Graph in a short window |
IP address | 144[.]172[.]64[.]128 (sign-ins and Graph API activity through ConnectWise apps, Storm-0940) |
IP address | 144[.]172[.]64[.]99 (password spray October 10 to 14, Storm-0940) |
IP address | 144[.]172[.]64[.]60 (Storm-0940) |
IP address | 187[.]15[.]88[.]186 (VPN IP, Graph API access through compromised apps, October 15 to 16, Storm-0940) |
IP address | 187[.]15[.]90[.]217 (VPN IP, Graph API access through compromised apps, October 15 to 16, Storm-0940) |
IP address | 187[.]15[.]89[.]186 (VPN IP, Graph API access through compromised apps, October 15 to 16, Storm-0940) |
Application ID | 506e08f9-6e9a-4da4-942b-a099a03644ae (ConnectWise Cloud Backup, affected app to inventory) |
Application ID | 24205314-2b89-4e07-a2a4-579e898a5640 (ConnectWise - MS Teams, affected app to inventory) |
Application ID | 0de14c77-b9b0-4137-9360-34878a929827 (ConnectWise - MS Graph, affected app to inventory) |
IP address | 199[.]19[.]95[.]66 (WISP C2 node, Storm-3358) |
IP address | 199[.]19[.]95[.]67 (WISP C2 node, Storm-3358) |
IP address | 199[.]19[.]95[.]68 (WISP C2 node, Storm-3358) |
IP address | 91[.]92[.]240[.]238 (ARTEX server, Storm-3358) |
IP address | 85[.]11[.]168[.]45 (ARTEX server, Storm-3358) |
IP address | 85[.]11[.]167[.]52 (C2 server, Storm-3358) |
IP address | 178[.]16[.]54[.]129 (ARTEX server, Storm-3358) |
IP address | 31[.]77[.]229[.]35 (ARTEX server, Storm-3358) |
Domain | nginxmysql[.]com (BLOODALCHEMY C2, VAPOR PANDA) |
Domain | sqlserver-sqlite[.]com (BLOODALCHEMY C2, VAPOR PANDA) |
Domain | www[.]ddduuuppp[.]com (BLOODALCHEMY C2, VAPOR PANDA) |
IP address | 45[.]153[.]126[.]223 (associated with nginxmysql[.]com, VAPOR PANDA) |
IP address | 89[.]46[.]234[.]50 (associated with sqlserver-sqlite[.]com, VAPOR PANDA) |
IP address | 192[.]121[.]47[.]20 (associated with www[.]ddduuuppp[.]com, VAPOR PANDA) |
SHA-256 | 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068 (GameHook binary renamed svchost.exe, VAPOR PANDA) |
SHA-256 | 3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4 (BLOODALCHEMY loader DLL graphics-hook-filter64.dll, VAPOR PANDA) |
SHA-256 | 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab (BLOODALCHEMY payload graphics-hook_config.bin, VAPOR PANDA) |
File path | C:\ProgramData\artx5v\ (VAPOR PANDA) |
Behavior | Command lines and cloud role names containing artx or artex (VAPOR PANDA) |
IP address | 38[.]244[.]50[.]120 (ARTEX console on ports 443 and 8090, Hunt.io. Threat actor-controlled) |
IP address | 154[.]201[.]79[.]246 (proxy service on port 443, Hunt.io. Proxy IP) |
IP address | 101[.]53[.]80[.]20 (proxy IP, South Korean bank attacks) |
IP address | 205[.]214[.]59[.]31 (proxy IP, South Korean bank attacks) |
IP address | 124[.]155[.]252[.]63 (proxy IP, South Korean bank attacks) |
IP address | 23[.]248[.]249[.]90 (proxy IP, South Korean bank attacks) |
IP address | 23[.]158[.]220[.]98 (proxy IP, South Korean bank attacks) |
IP address | 103[.]248[.]148[.]84 (proxy IP, South Korean bank attacks) |
IP address | 203[.]160[.]133[.]172 (proxy IP, South Korean bank attacks) |
IP address | 209[.]209[.]85[.]38 (proxy IP, South Korean bank attacks) |
IP address | 23[.]248[.]226[.]250 (jump server, open directory on port 18099, JNDI/LDAP rig on port 8001) |
IP address | 156[.]251[.]11[.]39 (ARTEX panel on port 8787, SMB toolkit) |
IP address | 130[.]94[.]31[.]86 (open directory on port 18888, ARTEX panel on port 878) |
IP address | 202[.]95[.]14[.]60 (open directory on port 18090) |
IP address | 118[.]107[.]47[.]11 (open directory on port 9999) |
IP address | 212[.]129[.]221[.]26 (open directory on port 8080) |
IP address | 149[.]88[.]85[.]20 (open directory on port 8899) |
Domain | xcai[.]pro and direct[.]xcai[.]pro (model routing in operator shims) |
Domain | fofoapi[.]com (FOFA client) |
Domain | u6ud2s[.]dnslog[.]cn (DNS callback in Exploit.class) |
Certificate | ARTEX TLS certificate, issuer organization ARTEX, SHA-256 C7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842 |
IP address | 169[.]128[.]55[.]214 (ARTEX in AWS) |
IP address | 154[.]64[.]252[.]77 (ARTEX in AWS) |
IP address | 154[.]36[.]136[.]197 (ARTEX in AWS) |
IP address | 154[.]36[.]136[.]23 (ARTEX in AWS) |
IP address | 102[.]216[.]154[.]102 (ARTEX in AWS) |
IP address | 82[.]158[.]88[.]233 (ARTEX in AWS) |
IP address | 88[.]229[.]22[.]232 (ARTEX in AWS) |
IP address | 103[.]54[.]154[.]40 (ARTEX in AWS) |
IP address | 103[.]54[.]154[.]32 (ARTEX in AWS) |
IP address | 45[.]145[.]228[.]25 (ARTEX in AWS) |
User agent | artex-readonly/1.0, artex-pentest/1.0, artex-audit/1.0, artex-spawn/1, artex-verify/1.0, ARTEX-worker/1.0, artex-i21861-canary, and strings containing "Mozilla/5.0 ARTeX" or "ARTeX-authorized-pentest" (ARTEX in AWS, Datadog) |
File name | artex-probe-* files |
Docker image | tomicdd/artex and congdonglinux/artex (backdoored ARTEX images) |
SHA-256 | d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573 (what it is, for example a backdoored ARTEX component) |
Behavior | Shell (sh -c) spawned by /app/artex |
Disclaimers
Information contained herein is current as of November 13, 2026, and is subject to change as new information and threat activity emerge. Recipients should not rely solely on this report for security decisions and should consult with their security teams and SentinelOne account representatives for current guidance.
All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third-party.
Related Articles
