cyber.hendryadrian.com
Detection & Defense · sophos.com

Sophos Details ARTEX Use in Intrusions and Offers Hunting Guidance

· Original article ↗

Summary

Sophos describes reported ARTEX use in intrusions, shares activity patterns and detection coverage, and recommends hunting indicators and steps to secure application identities. Microsoft attributes the ConnectWise Cloud Backup compromise to Storm-0940.

Key points

  • ARTEX is an open-source, Go-based multi-agent penetration-testing framework that can plan target activity, invoke offensive tools, and pursue multiple paths.
  • Sophos says multiple threat actors have used ARTEX since its public release in July 2026. Microsoft attributes the ConnectWise Cloud Backup compromise to Storm-0940, which it assesses as China-state aligned.
  • Reported campaigns used authentication material or compromised application credentials against cloud APIs and services, including Microsoft Graph.
  • Sophos observed customer activity consistent with ARTEX or other AI-assisted tooling, including webshell activity, SQL Server command execution, credential theft, and attempted lateral movement.
  • Sophos recommends hunting for application-added service principal credentials or role assignments, scripted-user-agent sign-ins, ARTEX-related temporary files, structured command markers, and bursts of repeated commands.
  • Recommended defenses include auditing Entra ID service principals and enterprise apps, reviewing credential and role changes since September 2026, applying Conditional Access where available, and automating containment for privileged access.

Article Details

Defense Focus
Detect and disrupt ARTEX-related and other AI-assisted offensive activity, especially misuse of application credentials, cloud role changes, suspicious command patterns, and webshell activity.
Detection Methods
  • Hunt for service principal credentials added or roles assigned by an application, and application sign-ins using scripted user agents.
  • On hosts, look for temporary tooling or output files matching i<intentID>[variant]_<purpose>.<ext>, especially files or paths beginning with artx under C:\Windows\Temp.
  • Look for structured execution-verification markers such as MARKER123 or ARTX123, particularly alongside rapid command sequences, repeated command variants, or output written to temporary files.
  • Review endpoint detections across initial access, server execution, credential theft and collection, lateral movement, tool transfer, webshells, and execution activity.
  • Hunt back to at least September 2026 for activity attributed by Microsoft to Storm-0940.
Data Sources
  • Microsoft Entra ID service principal and enterprise application audit events, including credential additions and role assignments
  • Application sign-in logs, including user-agent and authentication-failure information
  • Host endpoint telemetry, including command activity, temporary files, and file paths
  • Network-observable activity inspected by firewall and endpoint IPS signatures
Rule Types
  • Sophos Firewall and Endpoint IPS signatures for ARTEX-related network-observable behavior
  • Taegis XDR detection for application-added service principal credentials or roles, and scripted-user-agent sign-ins
  • Sophos Endpoint behavioral detections and Active Adversary Protection rules
  • File detections for the trojanized ARTEX Docker image and related detections
  • IP reputation blocking for IPs associated with publicly reported ARTEX use
Platforms
  • Microsoft Entra ID
  • Sophos Endpoint
  • Sophos Firewall
  • Taegis XDR
Defensive Actions
  • Audit service principals and enterprise applications in Microsoft Entra ID; remove unused third-party app consents and review credential additions and role assignments since September 2026.
  • Apply Conditional Access policies to workload identities where licensing allows, restricting application sign-ins to expected locations.
  • Alert on application sign-ins with scripted user agents and authentication-failure rates above normal baselines.
  • Automate rapid containment for attacks reaching privileged access, such as disabling a service principal or revoking its credentials, with analyst confirmation afterward.
  • Treat ARTEX copies obtained from unofficial mirrors or clones as untrusted.
  • Register authorized red-team frameworks, infrastructure, and tooling names with the SOC so legitimate activity can be distinguished.

MITRE ATT&CK

T1078.004 · Cloud AccountsOperators reportedly used stolen or compromised application credentials and valid accounts to access cloud APIs and services.T1098.001 · Additional Cloud CredentialsThe article recommends hunting for service principal credentials added by an application, an activity associated with the reported campaigns.T1098.003 · Additional Cloud RolesThe article recommends hunting for roles assigned to service principals by an application.T1505.003 · Web ShellSophos reports webshell activity among the themes seen in customer activity consistent with ARTEX or other AI-assisted offensive tooling.

Threat Actors

Storm-0940Microsoft attributes the ConnectWise Cloud Backup compromise in mid-October to Storm-0940 and assesses the group as China-state aligned. Microsoft claims the group was using ARTEX as early as September 2026.

Malware

Troj/Bckdr-SDAFile detection Troj/Bckdr-SDA (trojanized ARTEX Docker image)

Vendors

ConnectWisehave used in intrusions since its public release in July 2026. One of the most prominent cases is the ConnectWise Cloud Backup compromise in mid-October, which Microsoft attributes to Storm-0940, a group it assessesMicrosoft2026. One of the most prominent cases is the ConnectWise Cloud Backup compromise in mid-October, which Microsoft attributes to Storm-0940, a group it assesses as “China-state aligned.”SophosSophos X-Ops is tracking ARTEX, an open-source agentic AI penetration testing framework that multiple threat actors have used in intrusions since its public release in July 2026. One of the most prominent cases is the

Products

ConnectWise Cloud Backupused in intrusions since its public release in July 2026. One of the most prominent cases is the ConnectWise Cloud Backup compromise in mid-October, which Microsoft attributes to Storm-0940, a group it assesses asMicrosoft Entra IDAudit service principals and enterprise applications in Microsoft Entra ID. Remove third-party app consents you no longer use, and review every credential addition and role assignment made since September 2026.Microsoft Graphmaterial or compromised application credentials and used it against cloud APIs and services, such as Microsoft Graph.Sophos EndpointAcross these instances, existing Sophos Endpoint protections surfaced multiple signals at multiple stages of the attacks. In many cases, Active Adversary Protection (AAP) was enabled and added further protection toSophos FirewallSophos Firewall The following signatures have been released to Sophos Firewall and Endpoint IPS to cover network-observable ARTEX behaviours and indicators:Taegis XDRTaegis XDR ConnectWise Compromise: Service Principal Credential Added or Role Assigned by an Application

Tools

ARTEXSophos X-Ops is tracking ARTEX, an open-source agentic AI penetration testing framework that multiple threat actors have used in intrusions since its public release in July 2026. One of the most prominent cases is the

Countries

ChinaCloud Backup compromise in mid-October, which Microsoft attributes to Storm-0940, a group it assesses as “China-state aligned.”South KoreaAdditional reporting indicates that an ARTEX-related incident occurred in September 2026, targeting South Korean financial organizations.

Related Articles