AI hacking tool ARTEX used by four threat actors, two tied to China

Four separate threat actors used ARTEX, an open-source AI penetration-testing framework developed in China, in intrusions documented in October. Microsoft and CrowdStrike tie two of them to the Chinese state. The other two are a financially motivated actor that targeted South Korean banks and a single operator that Profero traced to Hong Kong.

ARTEX runs a team of AI agents against a target. A planner agent proposes attack paths, worker agents test them with standard tools, and the results go into a shared map of assets and findings, according to Microsoft. It works with any large language model. The developer published it in July and stopped public releases on 8 October, saying it had been built for learning and research, Korea JoongAng Daily reported. Copies of the code are still on GitHub.

The four operators

CrowdStrike reported the first case on 7 October. An unattributed, likely Chinese-speaking actor used ARTEX with DeepSeek, GLM and Grok models against Korean financial firms, and left Claude Code session histories in exposed directories. Zscaler puts the number of people whose data was taken at about 67,000, mostly from peripheral web applications. ARTEX's default blocklist excluded government and university targets but not financial institutions, Zscaler found.

Microsoft attributes the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, which it describes as China-state aligned. Using ConnectWise's own applications, ARTEX attempted sign-ins to more than 2,250 Microsoft 365 tenants. In several cases the actor reached privileged access less than three hours after first targeting an organisation. Microsoft says most of the targeting did not succeed. Google reports that the cluster it tracks as UNC7228 overlaps with Storm-0940, and Wiz saw the same infrastructure probing identity providers at software vendors.

CrowdStrike linked a single ARTEX controller to infrastructure used by VAPOR PANDA, a China-nexus espionage group. The controller exposed the group's tools, its target lists and transcripts of the ARTEX agents at work. From 17 October the group targeted more than 200 organisations in at least 14 countries over 11 days. CrowdStrike confirmed post-exploitation at nine, where the group deployed BLOODALCHEMY malware. The transcripts show ARTEX running several intrusions in parallel while a human operator gave instructions in Chinese. CrowdStrike considers this campaign separate from Storm-0940.

Profero describes one Chinese-speaking operator in Hong Kong who used ARTEX alongside a private set of AI tools and a residential proxy network against web applications and APIs. Profero found no link to the other three. None of the reports says the four are connected; each vendor attributes only the activity it observed.

Japan and the Seoul arrests

GMO Cybersecurity found ARTEX on attack infrastructure that targeted about 20 Japanese companies, eight of which disclosed data leaks in September and October, Impress Watch reported. JPCERT/CC has warned of attack attempts using ARTEX and similar frameworks. In Seoul, police arrested seven people in a separate case. Their leader, a 32-year-old, used ARTEX in most of the group's attacks on more than 90 organisations, BleepingComputer reported.

Detection

AhnLab counted about 600 servers hosting ARTEX and published user agents including artex-selfupdate and norma/0.4. Researcher Michael Koczwara says he has observed almost 2,200 ARTEX servers, more than Cobalt Strike and all other command-and-control frameworks combined, and has shown copies with renamed admin panels.

Nextron Systems has published ARTEX detection rules. Its founder, Florian Roth, writes that these identify the framework but not everything it does: "A webshell does not become an ARTEX-specific artifact because an ARTEX agent chose to deploy it." The attacks tend to be noisy, Wiz found, but they can progress faster than teams respond to the alerts. Plaintext researcher Julio Ureña showed that ARTEX and five other pentesting agents will run a backdoored file planted on a target site.

Microsoft advises ConnectWise customers to keep the affected app connections disabled, preserve logs before removing any enterprise applications, and review service-principal sign-ins and credential changes back to 1 October. Google expects criminal groups to continue adopting autonomous attack tools.