ARTEX: Agentic Pentest Framework Used in Real Attacks

ARTEX is no longer a hypothetical red-team demo. Between late September and late October 2026, CrowdStrike, Microsoft, TrendAI, GMO Cybersecurity by Ierae, Recorded Future, and Seoul Metropolitan Police all published evidence tying the open-source, multi-agent framework to real intrusions. The same tool appears in a Korean banking campaign, a Microsoft 365 supply-chain operation, attacks on Japanese companies, and a domestic Korean criminal case. The operators do not appear to be the same.

That is the important finding. The question is not whether organized groups have used ARTEX. The public record now says they have. The harder question is which groups, and what the framework actually changes. The evidence points to a smaller, more practical conclusion: ARTEX packages the intrusion lifecycle into an agent loop, and that loop lets a small team attempt more targets with less analyst time. It does not invent a new vulnerability, and it does not erase the need for an entry point.

What ARTEX is

ARTEX is an autonomous penetration-testing system built around multiple LLM-driven agents. The global-edition README describes a Go backend with a Next.js front end, a PostgreSQL data store, and a dual-graph design: an asset graph for domains, subdomains, services, applications, and endpoints, and a per-task exploration graph for goals, intents, facts, findings, and hints. A planner reads the exploration graph and emits intents; workers execute real tools against a single intent and write the results back into both graphs. The system can use any OpenAI-compatible model endpoint, and the UI and reports can switch between English, Korean, Chinese, Spanish, and Japanese.

“ARTEX is an autonomous offensive tool powerful enough to carry an attack from reconnaissance through intrusion to data exfiltration with little human involvement.”

— ARTEX Global Edition README, which also states the project is published for authorized testing and defensive research only.

The project’s own warning is not marketing modesty. The README says the upstream repository was unreachable as of October 2026, that the original developer reportedly took the project closed-source after the abuse became public, and that copies already in circulation cannot be recalled. The global edition is a localized fork under AGPL-3.0. That fork has thousands of stars and is not evidence of malicious use by itself. It is evidence that the code is widely available, reviewable, and forkable.

The framework’s capabilities are ordinary in isolation. It runs reconnaissance, searches for vulnerabilities, executes tools, records assets, and writes findings. What changes is the orchestration: the planner breaks a goal into a sequence, workers run in parallel where the dependency graph allows, and the system persists state across wakes. That is a meaningful reduction in the marginal cost of testing another target. It is not a magic exploit kit.

What the evidence actually shows

The strongest public evidence is a cluster of independent reports. They use different methods and measure different things, so the numbers should not be added together. “Targeted,” “attempted,” and “confirmed compromised” are not interchangeable.

The Korean banking case is the most detailed ARTEX intrusion. CrowdStrike assesses with moderate confidence that the operator is Chinese-speaking and financially motivated, not a state-directed actor. The operator ran ARTEX primarily on DeepSeek v4.1-flash, likely through an API reseller, and added GLM-5.3 and Grok 4.6 in separate Claude Code sessions. The operator also asked Claude where Korean breach data is typically sold, according to the CrowdStrike reconstruction. That detail matters less for attribution than for capability: the operator could move across model providers and separate agent runtimes while keeping the same intrusion workflow.

Microsoft’s Storm-0940 case is different in kind. It is a state-aligned actor using ARTEX in a global cloud supply-chain campaign. Microsoft describes two phases. Between October 10 and 14, a password-spray phase produced more than 151,000 unsuccessful logon events against 327 accounts at eight organizations, peaking at 2,900 failures per minute. None of those attempts succeeded. The more consequential path reached more than 2,250 tenants through pre-authorized, multi-tenant OAuth application identities tied to ConnectWise Cloud Backup. In one subset, the actor made more than 200 sign-ins in under four minutes using four application credentials. Agents then ran Microsoft Graph reconnaissance, added application credentials for persistence, and changed identities, groups, and privileged roles.

“Microsoft Threat Intelligence has identified threat actors across multiple geographic regions leveraging the ARTEX framework.”

— Microsoft Security Blog, October 21, 2026.

The Korean police case is the clearest example of the framework reaching conventional crime. Police described a group of seven suspects led by a former penetration tester, more than 90 victim organizations, about 8.2 million records, and extortion demands in 38 incidents. The leader adopted AI utilities in late August 2026 to expand a campaign that began in September 2025. ARTEX was used in most of the attacks, but the report does not say how many of the more than 90 intrusions came after that adoption. The totals cannot be credited to AI alone.

The Japanese reporting adds a second framework. GMO Cybersecurity by Ierae linked ARTEX to one attack server aimed at about 20 Japanese companies, and TrendAI documented a separate CyberStrikeAI operation with 44 agents against at least 19 organizations, at least 16 of them in Japan. TrendAI classed the case as “AI-driven rather than AI-assisted” because of the scale and consistency of the output. It also found the operator throttled traffic to each target to stay under detection thresholds and generated Japanese-language forms and fake login pages.

What it proves, and what it does not

The evidence supports several claims without qualification. Independent vendors and a police agency have linked the same open-source framework to real intrusions. The operators range from a state-aligned actor to a financially motivated crew to a domestic criminal group. The framework has been used against banks, cloud backup customers, and Japanese enterprises. The entry points in the disclosed cases were ordinary: an exposed administration interface, default or reused credentials, a legacy web system, or an over-privileged third-party application identity.

It does not support the claim that one organized group is behind all of it. The Cloud Security Alliance’s October 28 synthesis is explicit: as of that date, no published source had linked the separate campaigns to a single actor. The same framework appearing in multiple cases is evidence of a shared tool, not a shared command structure. Language is also weak evidence. TrendAI cautions that a Simplified Chinese working language “is only a weak clue to location or affiliation and cannot establish either.” CrowdStrike’s Chinese-speaking assessment is explicitly moderate confidence.

“The frameworks mostly add scale, speed, and repeatability rather than new ways in.”

— Cloud Security Alliance, Multi-Agent Offensive Frameworks in the Wild, October 28, 2026.

That sentence is the correct frame for defenders. ARTEX did not create a new class of vulnerability. It reduced the cost of trying the same known weaknesses across more targets, and it made the workflow repeatable enough that a small team could operate at a scale that used to require more people.

“AI has increased the scale and speed of these attacks, but the attackers are still looking for an unlocked door.”

— TrendAI, as quoted by the Cloud Security Alliance.

The public numbers are also a floor, not a ceiling. Much of what is known about the frameworks comes from attacker mistakes: open directories, exposed consoles, configuration files, and session histories. CrowdStrike and Recorded Future reconstructed the Korean campaign from exposed Claude Code session histories, ARTEX configuration files, and memory files. TrendAI rebuilt its Japanese cases from files left in publicly accessible directories. Microsoft’s Storm-0940 analysis is the main exception because it rests on its own telemetry. More careful operators using the same framework would leave fewer traces.

What else is out there

ARTEX is not the only packaged agentic offensive stack in the public record. The more useful question is which parts of the ecosystem are documented, and which parts are only inferred.

CyberStrikeAI is the closest documented peer. Its repository describes a Go application with single-agent, plan-execute, and supervisor multi-agent modes, MCP-native tool integration, more than 100 tool recipes spanning reconnaissance through post-exploitation, more than a dozen predefined testing roles, and support for any OpenAI-compatible model endpoint. It also includes approval gates, tool allowlists, and audit logs. Those safeguards are optional design features; an operator who controls the deployment can disable them. Team Cymru observed 21 unique IP addresses running the tool between January 20 and February 26, 2026, and found a CyberStrikeAI service banner on a server linked to the FortiGate campaign. Amazon described that campaign as an “AI-powered assembly line for cybercrime,” with more than 600 FortiGate devices in over 55 countries, exposed management ports, and weak single-factor credentials.

The model layer is just as important as the framework. CrowdStrike’s Korean case used DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6, plus separate Claude Code sessions. Because the frameworks accept any OpenAI-compatible endpoint, a single provider’s safety controls cannot reliably stop an operator. A blocked account can move to another provider, a reseller, or stolen credentials. The Cloud Security Alliance’s LLMjacking work treats stolen inference capacity as part of offensive agent infrastructure, not a separate curiosity.

There is no public evidence that every agentic security tool is being used maliciously. The correct reading is narrower: the category is now packaged, documented, and reused across unrelated operators. That is enough to make it a defender problem.

Defensive priorities that follow from the evidence

The disclosed entry points are not exotic. They are the same doors defenders have been told to close for years. The difference is the rate at which they can be tested.

1. Treat external administration surfaces as the first control

Inventory internet-facing web systems, administration interfaces, VPN appliances, and edge devices. Remove default credentials. Require MFA on every management path. Isolate or retire legacy systems that cannot be patched. Rotate credentials stored in device configuration backups; one Japanese case relied on router credentials recovered from configuration files.

2. Audit non-human identities, not just users

Microsoft’s Storm-0940 path ran through pre-authorized, multi-tenant OAuth application identities. Review service principals and OAuth applications for recent credential additions, new owners, consent grants, and privileged role assignments. Search by application ID rather than display name. If a ConnectWise Cloud Backup connection was authorized, follow Microsoft’s sequence: keep the affected connections disabled, preserve Entra, Purview, and SIEM evidence before changing anything, and review activity from at least October 1, with special attention to October 10–14 for the password-spray phase.

3. Change detection for agent-driven traffic

TrendAI observed per-target throttling designed to stay under threshold alerts. Per-source rate limits are not enough. Correlate low-frequency attempts across assets and time. Look for Graph reconnaissance, application-credential additions, role changes, and identity changes that do not match a change ticket. Monitor egress to unapproved LLM APIs and reseller endpoints; a compromised host used as agent infrastructure looks like outbound API traffic, not a classic malware beacon.

4. Use the defenders’ material the ARTEX project has published

The global edition ships a defense and detection guide, Sigma and Suricata rules, a MITRE ATT&CK layer, a machine-readable indicator CSV, a MISP event, and a read-only host triage script. Those are useful starting points, not proof of absence. The Cloud Security Alliance’s synthesis says the published campaign counts are a lower bound because much of the detail came from attacker mistakes.

5. Run authorized agentic testing against your own environment

The Cloud Security Alliance recommends continuous automated external attack-surface testing as a baseline control. Running an authorized agentic tool against your own estate, under written scope, is one way to see the same exposed interfaces and weak identities an attacker’s planner will see. The point is not to deploy ARTEX against someone else. The point is to stop treating the agentic speed advantage as theoretical.

The bottom line

ARTEX has been used in real intrusions by a state-aligned actor, a financially motivated crew, and a domestic criminal group. That is the answer to the evidence question. It is not evidence of one organized group, and it is not evidence that AI invented a new way through a firewall. The public record shows a reusable orchestration layer that makes ordinary weaknesses cheaper to find and exploit at scale.

The most important defensive sentence in the reporting is also the least dramatic: the attackers still need an unlocked door. The most important operational sentence is that the door is now tested faster, across more targets, with fewer people. Organizations that close the ordinary doors and govern the non-human identities behind them are not immune. They are simply harder to include in the next batch.

Sources

• Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, October 21, 2026.
• Cloud Security Alliance: Multi-Agent Offensive Frameworks in the Wild: CyberStrikeAI and ARTEX, October 28, 2026.
• CrowdStrike: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance, October 7, 2026.
• Recorded Future: TAG-217 Targets South Korean Financial Services with ARTEX, October 2026.
• BleepingComputer: Former pentester used ARTEX AI to steal 8.2 million data records, October 26, 2026.
• TrendAI: Not Only ARTEX: The Different Levels AI Is Used in Attacks Targeting Japan, October 27, 2026.
• GMO Cybersecurity by Ierae: Many Sources of the Recent Unauthorized Access Incidents Confirmed to Be AI, October 19, 2026.
• Team Cymru: Tracking CyberStrikeAI, March 2, 2026.
• Amazon Threat Intelligence: AI-Augmented Threat Actor Accesses FortiGate Devices at Scale, February 20, 2026.
• ARTEX Global Edition repository and README, accessed November 2026.
• CyberStrikeAI repository, accessed October 28, 2026.

Attribution note: this article distinguishes what vendors and police reported from what the public record does not establish. Framework use is not actor attribution. The figures are not additive because the reports measure different things.