Hunting ARTEX: what six weeks of AI-driven intrusions teach defenders
ARTEX turned autonomous AI attacks from a research demo into a commodity. We read every public incident write-up and turned the signals into hunts you can run today.
TL;DR: ARTEX is an open-source framework that lets one operator point a team of LLM agents at a target and walk away. Since late September 2026 it has been used against banks, fintechs, SaaS providers and EU institutions by at least four unrelated groups. Defenders who have written up these intrusions agree on three things. The agents move in minutes. They are loud. And they keep every way in they find. Our new ARTEX pack schedules the hunts these reports point to, across endpoints, AWS, GitHub, Kubernetes and Cloudflare.
→ Install the ARTEX pack from Library › Packs
From pen-test tool to threat in three months
A developer published ARTEX on GitHub in July 2026 as an "AI-native penetration framework". An operator gives it a target and an objective. A planner agent breaks that into tasks, hands them to worker agents three at a time, and records everything it learns on a shared "blackboard" of facts and findings. It works with OpenAI-style and Anthropic-style APIs, and when one provider bans a key it moves to the next.
The source went closed on 8 October, after more than 12,000 forks. By then it was already in use:
| Date | Report | What it showed |
|---|---|---|
| 7 Oct | CrowdStrike | First ARTEX intrusions, against South Korean financial firms. The actor's open directories leaked its session histories and configs |
| 21 Oct | Microsoft | Storm-0940 used stolen ConnectWise app credentials against 2,250+ Microsoft 365 tenants, with under 3 hours from targeting to privileged access in some cases |
| 29 Oct | CrowdStrike | VAPOR PANDA hit 200+ organisations in 14+ countries in 11 days. One planner agent used about 1.4 billion input tokens in a single intrusion |
| 4–5 Nov | CERT-In, CERT-EU, Check Point | Advisories for Indian finance and EU institutions. Check Point counted 2,557 hosts that had served ARTEX panels, and campaigns costing roughly $145 to $1,500 each |
| 6 Nov | Microsoft | Storm-3358, a criminal cluster, used anonymous file upload and SSRF to drop web shells and RATs in Southeast Asian finance |
| 9 Nov | Datadog Security Labs | ARTEX in AWS: anonymous S3 reads, CloudWatch Logs searched for secrets, self-registration in public Cognito user pools |
| 12 Nov | Eye Security | A full incident response: PHP upload to web shell, Kubernetes, CI runners and a comeback within an hour of going live again |
The precedent is a year old. In November 2025 Anthropic disrupted GTG-1002, a state-sponsored campaign in which AI did 80–90% of the work. ARTEX is that capability packaged, documented and forked twelve thousand times.
What the incidents have in common
Speed. Eye Security watched a stolen API key used within minutes of discovery. When a rate limiter blocked the agents, a new version that spoofed the client IP header was running about three minutes later. When a WAF rule blocked them, they copied the one user agent the rule trusted, again in about three minutes. Microsoft recorded a password spray peaking at 2,900 attempts a minute.
Noise. Every write-up says the same thing: on hosts and in logs, these agents are easy to see. They leave files and pods named artx_, artx-pod and zzartx0000.php. They send user agents like artex-pentest/1.0. They request a path that can't exist (/zzz-nonexistent-xyz123) to learn what "not found" looks like before they start guessing. Eye Security put it plainly: the attacks were "very noisy and easy to identify on the side of the hosts".
Breadth. A human attacker picks one way to stay in. ARTEX keeps all of them. In Eye Security's case that meant web shells, a Neo-reGeorg tunnel, a malicious commit that made the deployment pipeline recreate attacker pods within a second of deletion, self-hosted CI runners re-registered every eight minutes overnight and backdoor admin accounts named qa_probe_*. The customer went live again after a day. Less than an hour later, the attacker was back.
Adaptation. Datadog watched an agent read the error messages from a Cognito PreSignUp check and change its input until registration went through, probing for a custom:isAdmin attribute along the way. CERT-EU notes that ARTEX chains low-severity misconfigurations that a human tester would skip.
People are still in the loop. CrowdStrike saw operators issuing commands mid-intrusion, such as asking the agents to find Windows machines without EDR. Check Point found agents that hallucinated findings. Anthropic saw the same in 2025. Expect some of what an agent claims to have done to be false, and some of its next moves to come from a person.
Six lessons for defenders
- Hunt where the agents are loud. Default markers, probe requests and bursts of denied calls are cheap to find. They are also easy for an operator to change, so pair them with behaviour checks.
- Find every way in, not the way in. Before you bring a system back, list every foothold: shells, tunnels, runners, commits, pods, accounts, keys. Then cut off the source that recreates them, such as the repository or the pipeline, before deleting what it made.
- Rotate every exposed secret, not just the first one used. An agent that reads an environment file tries every key in it, along every path, at once.
- Watch CI and deployment as closely as production. Runner registrations and deployment changes were persistence in Eye Security's case. CERT-In saw staging environments used to reach production.
- Don't trust a user agent. Allow trusted callers by address, mutual TLS or a signed header.
- Expect the attacker on a weekend. Agents don't keep office hours. CERT-In recommends lower alert thresholds outside working hours.
How to hunt for ARTEX
| Where | What to look for |
|---|---|
| Web servers | New PHP, PHTML or PHAR files in upload folders. Files named artx_* or zzartx*. Odd extensions in /tmp |
| Endpoints | Command lines naming ARTEX, Neo-reGeorg or callback services (dnslog.cn, oast.me, webhook.site). C:\ProgramData\artx* on Windows. Local accounts named qa_probe_* |
| Kubernetes nodes | nsenter. Processes other than the runtime holding the Docker, containerd or CRI-O socket. New privileged pods or pods sharing host namespaces |
| CI | Self-hosted runner registrations, especially many by one actor. Runners named sink-* |
| AWS | FilterLogEvents bursts with a constant limit of 1000. Cognito SignUp floods and PreSignUp errors. Anonymous S3 reads. ARTEX user agents in CloudTrail |
| Microsoft 365 / Entra ID | Applications granting themselves admin roles. Credentials added to existing apps and service principals. Bulk Key Vault reads |
| Edge | Allow rules keyed on user agent. Requests for paths that can't exist, followed by a burst of guesses |
The ARTEX pack
The ARTEX pack turns that table into scheduled hunts. Install it from Library › Packs and it starts checking, on your existing connections:
- Endpoint Control (Early access): ARTEX marker files, attack tooling and tunnel processes, container escape activity, self-hosted CI runners and backdoor account names.
- AWS: CloudTrail events from ARTEX user agents and addresses, CloudWatch Logs searches by identity, Cognito sign-ups by source and user pools open to self sign-up.
- GitHub: self-hosted runner registrations from the organisation audit log.
- Kubernetes: ARTEX pods, and new pods that are privileged or share the host's namespaces.
- Cloudflare: firewall rules that trust a user agent.
It also adds 20 hunt playbooks from Huntbase Hub to your library, four of them written for ARTEX, along with the catalogue queries you need to scope an intrusion. Its report template, AI-driven intrusion review, is organised around closing every foothold. Pair it with the Identity Threats pack for the Microsoft 365 and Entra ID side.
When a check finds something, Scout picks it up as an investigation partner. Scout walks the process tree, ties the host to the identity, repository or pod behind it, and looks for the other footholds an agent like this leaves. Response actions (Early access) such as isolating a host, blocking an address or quarantining a file wait for a person to approve them.
The pack is available on every plan.
Published indicators
These come from the public reports below. ARTEX operators use residential and hosting proxies that rotate quickly, so treat addresses as leads, not verdicts. Seeing ARTEX tells you the tool, not who is using it.
| Type | Indicators | Source |
|---|---|---|
| User agents | Mozilla/5.0 (ARTEX), ArtExVerify/1.0, artex-readonly/1.0, artex-pentest/1.0, artex-audit/1.0, artex-verify/1.0, artex-spawn/1, ARTEX-worker/1.0, Mozilla/5.0 ARTeX | Eye Security, Datadog |
| Domains | artex[.]lol, staging[.]artex[.]lol, xcai[.]pro | Eye Security, CrowdStrike |
| Container images | tomicdd/artex, congdonglinux/artex | Eye Security |
| Markers | artx_* files and databases, artx-pod, zzartx0000.php, X-ARTX-KEY header, qa_probe_* accounts, sink-* runners, C:\ProgramData\artx5v\ | Eye Security, CrowdStrike |
| Addresses (AWS activity) | 103.54.154[.]40, 103.54.154[.]32, 154.64.252[.]77, 154.36.136[.]197, 154.36.136[.]23, 169.128.55[.]214 | Datadog |
| Addresses (Storm-0940) | 144.172.64[.]128, 144.172.64[.]99, 144.172.64[.]60 | Microsoft |
Sources
- Eye Security, How we defended against an AI-driven attack, 12 November 2026
- Datadog Security Labs, On the hunt for ARTEX: understanding agentic attacks in AWS environments, 9 November 2026
- Microsoft, ARTEX abuse expands as cybercriminals target financial sector, 6 November 2026
- Check Point Research, Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns, 5 November 2026
- CERT-EU, From Penetration Testing to Cyber Threat: Beware of ARTEX, 5 November 2026
- CERT-In, CIAD-2026-0058, 4 November 2026
- CrowdStrike, VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign, 29 October 2026
- Microsoft, Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise, 21 October 2026
- CrowdStrike, Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance, 7 October 2026
- Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, 13 November 2025
Have you seen ARTEX in your environment, and which signal caught it first?