Log in Request a demo

Malware profile

ARTEX: The Open-Source AI Pentest Framework Attackers Use

Also known as ARTEX

ARTEX is an open-source, multi-agent AI penetration testing framework that can use any AI model.

In short

ARTEX is an open-source, multi-agent AI penetration testing framework that can use any AI model. Google Threat Intelligence says threat actors have used it in real intrusions since late August 2026. Microsoft and CrowdStrike tie it to China-aligned and North Korean groups.

Last updated 31 October 2026

Profile MapMalware
  1. Techniques18ATT&CK techniques listedResource Development · Reconnaissance · Initial Access
  2. Infection Steps7in the delivery chainInitial recon · Foothold

In one minute

What it is
An open-source framework of AI agents that runs a penetration test, from reconnaissance to data exfiltration, with little human input. It works with any AI model.
What it does
Attackers give it a target and often stolen credentials. Its agents then test permissions, write web shells and try to move through the network in bursts of seconds.
Who uses it
Microsoft names Storm-0940, Onyx Sleet and Pearl Sleet, and CrowdStrike names VAPOR PANDA. Google Threat Intelligence also saw financially motivated extortion groups use it.
How it gets in
In the reported cases, runs started from stolen credentials, a compromised vendor app or a flaw in an internet-facing application.
What to do first
Hunt for its markers, such as "artx" or "artex" in command lines and the folder C:\ProgramData\artx5v\. Then alert on bursts of API calls no human could make.

What it does

Microsoft describes ARTEX as a multi-agent LLM system written in Go with a Next.js frontend. Its agents run a penetration test from reconnaissance to data exfiltration with little human input. Google Threat Intelligence Group (GTIG) says attackers who once misused red-team tools such as Cobalt Strike are now turning to AI frameworks like this one.

MITRE ATT&CK has no software entry for ARTEX. The technique list below comes from the mappings Microsoft and CrowdStrike published for campaigns in which ARTEX ran, not from a reading of the tool’s code. Our news posts cover the Storm-0940 ConnectWise supply chain attack, the VAPOR PANDA ARTEX campaign and North Korea’s use of AI in attacks.

What it can do

The ATT&CK techniques the cited sources map to this tool, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Resource Development

  • Obtain Capabilities: Artificial Intelligence T1588.007

    CrowdStrike maps VAPOR PANDA's use of the ARTEX agent framework itself to this technique.[3]

Reconnaissance

  • Active Scanning T1595

    Microsoft says Storm-0940 used ARTEX to speed up scanning of cloud resources to find targets.[1]

Initial Access

  • Exploit Public-Facing Application T1190

    CrowdStrike says an ARTEX agent chained an unsigned SAML assertion and an XXE flaw at a US pharmaceutical organization.[3]

  • Valid Accounts: Cloud Accounts T1078.004

    Microsoft says the agents signed in to customer tenants with stolen credentials of ConnectWise cloud apps.[1]

  • Trusted Relationship T1199

    Microsoft says the access came through a trusted third-party app that tenants had already authorized.[1]

Execution

  • Cloud Administration Command T1651

    CrowdStrike says the agents issued commands to cloud instances through a cloud systems manager.[3]

Persistence

  • Server Software Component: Web Shell T1505.003

    CrowdStrike lists JSP and PHP web shells. GTIG saw ARTEX turn MySQL log files into JSP web shells.[3, 4]

  • Account Manipulation: Additional Cloud Credentials T1098.001

    Microsoft says the agents changed application credentials, and that such changes can outlast clean-up of the original app.[1]

Privilege Escalation

  • Account Manipulation: Additional Cloud Roles T1098.003

    Microsoft lists privileged role assignments, including a ConnectWise management app giving itself Global Administrator.[1]

  • Access Token Manipulation: Token Impersonation/Theft T1134.001

    CrowdStrike says an agent abused resource-based constrained delegation to impersonate a privileged account.[3]

Credential Access

  • Brute Force: Password Spraying T1110.003

    CrowdStrike lists password spraying in the VAPOR PANDA campaign. Microsoft says Storm-0940 used ARTEX to speed up spraying, but its technique table leaves it out.[1, 3]

  • Unsecured Credentials: Cloud Instance Metadata API T1552.005

    CrowdStrike says an agent queried the cloud metadata service through an XXE flaw to get role credentials.[3]

  • Forge Web Credentials: SAML Tokens T1606.002

    CrowdStrike lists the submission of unsigned SAML assertions.[3]

  • Credentials from Password Stores: Cloud Secrets Management Stores T1555.006

    Microsoft lists bulk secret reads from Azure Key Vaults.[1]

Discovery

  • Account Discovery: Cloud Account T1087.004

    Microsoft lists the search for privileged cloud accounts to target next.[1]

  • Cloud Infrastructure Discovery T1580

    Microsoft lists mapping of cloud infrastructure for further targeting.[1]

  • Software Discovery: Security Software Discovery T1518.001

    CrowdStrike says the operator told the agents to find Windows hosts without the CrowdStrike Falcon sensor.[3]

Collection

  • Email Collection: Remote Email Collection T1114.002

    CrowdStrike says the agents read mailboxes on a compromised mail server.[3]

How it spreads

ARTEX is open-source software, so anyone can run it. GTIG says its creator took the original GitHub repository down in October 2026 because of widespread abuse. Community forks keep it spreading, including localized versions such as ScopeWeaver and a commercial version called ARTEX PRO. In Brandefense Blackhole, 52 posts on Telegram, Discord and forum channels mentioned ARTEX between 17 and 30 October; most reshared news, and a few linked public copies of the code.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Initial recon

    Across Mandiant cases, GTIG saw ARTEX test what stolen Azure credentials could do, writing and deleting a test blob in about 330 to 400 ms.[4]

  2. Foothold

    It abused Kudu administrative APIs to run commands and sent results back through 491 rotating webhook.site URLs.[4]

  3. Escalate privileges

    It ran Kerberoasting scripts and dumped database credentials through SQL injection. After an offline cracking pause, it ran DCSync scripts.[4]

  4. Internal recon

    Generated PowerShell scripts listed domain users, service accounts and certificate templates, and mapped thousands of cross-forest principals.[4]

  5. Lateral movement

    It tried Pass-the-Ticket, WinRM, Kerberos relay and Pass-the-Hash scripts on domain controllers until endpoint protection blocked execution.[4]

  6. Persistence

    It reset user passwords and created administrator accounts, some with ArtexProbe in the name.[4]

  7. Mission

    It queried backend databases, read storage in bulk and listed more than 110,000 Active Directory objects.[4]

Timeline

  1. Late Aug 2026

    First intrusions with ARTEX

    GTIG says threat actors have used ARTEX in Mandiant incident response cases since late August 2026.[4]

  2. Sep 2026

    Storm-0940 starts using it

    Microsoft says Storm-0940 used ARTEX as early as September 2026 against hundreds of organizations.[1]

  3. Oct 2026

    Original repository taken down

    GTIG says the creator removed the original GitHub repository because of widespread abuse. Forks kept spreading.[4]

  4. 17 Oct 2026

    VAPOR PANDA campaign begins

    CrowdStrike says one ARTEX controller went after more than 200 organizations in at least 14 countries over 11 days.[3]

  5. 21 Oct 2026

    Microsoft names Storm-0940

    Microsoft ties ARTEX to Storm-0940 and to the ConnectWise supply chain compromise.[1]

  6. 29 Oct 2026

    North Korean use and VAPOR PANDA report

    Microsoft says Onyx Sleet and Pearl Sleet have used ARTEX since late October. CrowdStrike publishes its VAPOR PANDA findings.[2, 3]

  7. 30 Oct 2026

    Google Threat Intelligence report

    GTIG and Mandiant describe ARTEX in incident response cases, including use by financially motivated extortion groups.[4]

Detection and defense

  1. Hunt for ARTEX markers

    CrowdStrike lists "artx" or "artex" in command lines, cloud roles starting with "artx", "art18-" comments on admin commands and C:\ProgramData\artx5v\. GTIG adds artex-probe files and ArtexProbe account names.[3, 4]

    Counters: T1651 T1505.003

  2. Alert on machine-speed bursts

    GTIG saw ARTEX run in bursts of about 2 to 25 seconds. Alert on sudden runs of management API calls, permission tests and resource listing.[4]

    Counters: T1580 T1087.004

  3. Check scripted sign-ins

    In the ConnectWise case, Microsoft lists Python-urllib/3.12, python-requests/2.31.0, python-requests/2.34.2, curl/7.88.1 and azure-toolkit/1.0 as user agents behind sign-ins and Graph calls.[1]

    Counters: T1078.004 T1199

  4. Watch new outbound services

    GTIG saw ARTEX post command output to rotating webhook.site URLs. Flag a server that suddenly contacts webhook, file-sharing or LLM services it never used before.[4]

    Counters: T1651

  5. Use the published detections

    Microsoft lists Defender XDR alerts such as Application self-assigned Global Administrator role, and a Defender for Key Vault alert for bulk secret access.[1]

    Counters: T1098.003 T1555.006

  6. Remove old keys and weak SAML

    CrowdStrike advises rotating signing keys and service credentials after any exposure, including old backups and directory exports. It also advises SAML signature checks and IMDSv2.[3]

    Counters: T1606.002 T1552.005

  7. Limit what one identity reaches

    GTIG advises short-lived, tightly scoped credentials, least privilege and segmentation, so one stolen identity gives an agent little to work with.[4]

    Counters: T1078.004 T1098.001

Questions

What is ARTEX?

ARTEX is an open-source, multi-agent AI penetration testing framework written in Go with a Next.js console. Microsoft says it can use any AI model. GTIG says it splits the attack lifecycle across six specialized sub-agents.

Is ARTEX malware?

No. It is a penetration testing framework, like the red-team tools attackers have long misused. Threat actors now use it in real intrusions, so we list it as a legitimate tool that attackers abuse.

Who uses ARTEX?

Microsoft names the China state-aligned actor Storm-0940 and the North Korean groups Onyx Sleet and Pearl Sleet. CrowdStrike names the China-nexus VAPOR PANDA. GTIG also saw financially motivated extortion groups use it.

Does MITRE ATT&CK list ARTEX?

Not as of 31 October 2026: ATT&CK v19 has no software entry for it. The techniques on this page come from the mappings Microsoft and CrowdStrike published for campaigns in which ARTEX ran.

How can defenders spot ARTEX?

Hunt for its markers, such as "artx" or "artex" in command lines and artex-probe files. GTIG says ARTEX trades stealth for speed, so bursts of API calls and noisy trial and error in logs are good signals.

In our research

  1. VAPOR PANDA and ARTEX: How AI Agents Ran a China-Nexus Espionage Campaign October 2026
  2. Storm-0940 Used ARTEX Against ConnectWise: What Microsoft 365 Admins Should Check October 2026
  3. North Korea AI Hacking: What Microsoft Documented Across Eight Groups October 2026
  4. How Cybercriminals Are Attacking Financial Firms Worldwide October 2026
  5. Cybersecurity News This Week: 9 Stories That Mattered, 19 to 25 October 2026 October 2026
  6. LiteLLM 1.107.0 Supply Chain Attack: Timeline, Stolen Data and a Response Checklist October 2026

Sources

  1. AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise Microsoft Threat IntelligenceSupports: ARTEX description, Storm-0940 use from September 2026, ConnectWise case, technique table, user agents and Defender detections.
  2. Tracking AI adoption in North Korean threat actor tradecraft Microsoft Threat IntelligenceSupports: Onyx Sleet and Pearl Sleet use of ARTEX since late October 2026.
  3. VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign CrowdStrikeSupports: VAPOR PANDA campaign from 17 October 2026, agent design, technique table, ARTEX markers and recommendations.
  4. ARTEX and Friends: Enter Agentic Offensive Frameworks Google Threat Intelligence GroupSupports: Use since late August 2026, repository takedown and forks, observed tradecraft by attack phase, burst timing and defenses.
  5. Enterprise Techniques MITRE ATT&CKSupports: Technique ids and names (ATT&CK v19); no software entry for ARTEX.

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

VAPOR PANDA

CrowdStrike tracks VAPOR PANDA as a China-based, state-sponsored targeted intrusion adversary and first saw it in February 2021. From 17 October 2026, CrowdStrike says, the group used the ARTEX agentic AI framework against more than 200 targets.

Read more

Glossary term

Penetration testing

Penetration testing is security testing in which evaluators mimic real-world attacks to find ways around the security features of an application, system or network.

Read more