ARTEX AI Framework Linked to Multiple 2026 Intrusion Campaigns

Nov 5, 2026 · Original article ↗

Summary

SOCRadar reviews reports linking ARTEX, an LLM-agent pentesting framework, to espionage and financially motivated intrusions. CrowdStrike reported 200+ targets and nine confirmed post-exploitation victims; suggested defenses focus on identity hardening and behavior-

Key points

ARTEX is a Go-based, multi-agent penetration-testing framework used in reported intrusions; its developer closed the original project in October 2026, but forks remain available.
CrowdStrike reported that Vapor Panda used one ARTEX controller to target more than 200 organizations in at least 14 countries over 11 days, with post-exploitation confirmed at nine victims.
Microsoft attributed ConnectWise Cloud Backup credential abuse to Storm-0940, which attempted sign-ins across more than 2,250 Microsoft 365 tenants. ConnectWise disabled seven affected application identities and began phased restoration.
WorkOS disclosed unauthorized access to an internal sales and marketing application, exposing business contact and account information and excerpts from sales, support, and customer conversations. It said production services and app data were unaffected.
Reported techniques include password spraying, abuse of over-permissioned application identities, unrotated keys, unsigned SAML assertions, XXE, Kerberoasting, and DCSync.
Recommended defenses include reducing third-party app permissions, rotating long-lived keys, enforcing phishing-resistant MFA, restricting metadata access, and hunting for machine-paced activity.

Article Details

Attack Vectors: ARTEX agents used stolen credentials for ConnectWise Cloud Backup application identities with consented permissions in customer Microsoft 365 tenants, enabling access without interactive user sign-in.
Storm-0940 attempted sign-ins across more than 2,250 tenants; related activity included password-spraying hundreds of accounts at one-second intervals.
Vapor Panda used an unsigned SAML assertion and an XML external entity (XXE) flaw to query a cloud metadata service.
Reported techniques included Kerberoasting and DCSync against Active Directory, including theft of the krbtgt key, cloud sync credentials, and domain controller hashes.
Agents used web shells, LAPS password retrieval, resource-based constrained delegation, and forged administrator tokens using unrotated mail-server keys.
Command output was exfiltrated through rotating webhook.site URLs.
The South Korean bank intrusions involved theft of customer data from auxiliary systems; the article reports that affected banks said financial transaction data was not exposed.
Defensive Notes: Inventory multitenant application identities with consent in Entra ID, remove unused apps, apply least privilege, and alert on new credentials, owners, or role assignments.
Rotate long-lived mail-server signing keys, SAML certificates, and API secrets; reject unsigned SAML assertions.
Enforce IMDSv2 on AWS workloads, restrict cloud metadata endpoints, and disable external entity processing in XML parsers.
Require phishing-resistant MFA, enable smart lockout, block legacy authentication through Conditional Access, and alert on password-spray failure bursts.
Patch exposed systems and remove management or container-orchestration interfaces from the public internet.
Limit read access to LAPS password attributes and monitor changes to msDS-AllowedToActOnBehalfOfOtherIdentity.
Hunt for machine-paced sign-in and directory-query patterns, anomalous service-principal activity, ARTEX-related artifacts, and repeated outbound requests to webhook services.
Preserve sign-in, audit, and SIEM records before deleting applications or credentials.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`nginxmysql[.]com`	Identified as a Vapor Panda command-and-control domain.
DOMAIN	`sqlserver-sqlite[.]com`	Identified as a Vapor Panda command-and-control domain.
DOMAIN	`www[.]ddduuuppp[.]com`	Identified as a Vapor Panda command-and-control domain.
IPV4	`144[.]172[.]64[.]128`	Reported as the primary vector for vendor-credential application sign-ins in the Storm-0940 campaign.
IPV4	`144[.]172[.]64[.]60`	Reported in connection with failed user logins on October 18 in the Storm-0940 campaign.
IPV4	`144[.]172[.]64[.]99`	Cited by Microsoft as used for password spraying in the Storm-0940 campaign.
IPV4	`192[.]121[.]47[.]20`	Identified as a Vapor Panda command-and-control address.
IPV4	`38[.]244[.]50[.]120`	Reported as an ARTEX instance host associated with attacks on South Korean banks.
IPV4	`45[.]153[.]126[.]223`	Identified as a Vapor Panda command-and-control address.
IPV4	`89[.]46[.]234[.]50`	Identified as a Vapor Panda command-and-control address.
SHA256	`364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab`	Hash of graphics-hook_config.bin identified in the Vapor Panda/BLOODALCHEMY campaign.
SHA256	`3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4`	Hash of graphics-hook-filter64.dll identified in the Vapor Panda/BLOODALCHEMY campaign.
SHA256	`49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068`	Hash of a renamed GameHook executable (svchost.exe) identified in the Vapor Panda/BLOODALCHEMY campaign.