ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data Theft

Key facts for ARTEX AI pentest framework

Detection coverage for ARTEX AI pentest framework

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5032 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX MySQL general_log JSP Webshell Poisoning (UNC7228 / Storm-0940) — Exploitation

Detects the ARTEX/UNC7228 technique of abusing SQL injection plus FILE/SUPER privileges to repoint MySQL general_log_file at a web-accessible .jsp path and log a query containing JSP shell code, producing an ephemeral webshell (cl1217.jsp, f1219a.jsp, z1219.jsp observed by Google GTIG). Covers the SQL-level indicator (SPL/KQL) and the resulting file write by the database process (KQL/Sigma).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1505.003
• Data sources: mysql:generalQueryLog, mysql:auditLog, AzureDiagnostics (MySqlAuditLogs), DeviceFileEvents, linux file_event
• Severity: critical
• Confidence: high

Splunk SPL

index=database (sourcetype="mysql:generalQueryLog" OR sourcetype="mysql:auditLog" OR sourcetype="mysql:queryLog") earliest=-24h "general_log_file" ".jsp"
```ARTEX MySQL log poisoning: SET GLOBAL general_log_file pointed at a web-accessible .jsp, then a query carrying the JSP shell code is logged into it```
| rex field=_raw "(?i)general_log_file\s*=\s*[\x27\x22]?(?<log_path>[^\x27\x22\s;]+\.jsp)"
| where isnotnull(log_path)
| eval known_artex_shell=if(match(log_path,"(?i)(cl1217|f1219a|z1219)\.jsp$"),"yes","no")
| stats count as events min(_time) as first_seen max(_time) as last_seen values(log_path) as webshell_path values(known_artex_shell) as known_artex_shell values(user) as db_user values(src) as src_host by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - events

Microsoft KQL

let mysql_audit = AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceProvider == "MICROSOFT.DBFORMYSQL" and Category == "MySqlAuditLogs"
    | where sql_text_s has "general_log_file" and sql_text_s has ".jsp"
    | project TimeGenerated, Host = Resource, Actor = event_class_s, Detail = sql_text_s, Signal = "MySQL general_log_file set to .jsp";
let jsp_drop = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("FileCreated", "FileModified")
    | where InitiatingProcessFileName in~ ("mysqld", "mysqld.exe", "mariadbd", "mariadbd.exe")
    | where FileName endswith ".jsp"
    | project TimeGenerated = Timestamp, Host = DeviceName, Actor = InitiatingProcessAccountName, Detail = FolderPath, KnownArtexShell = FileName in~ ("cl1217.jsp", "f1219a.jsp", "z1219.jsp"), Signal = "JSP file written by database server process";
union isfuzzy=true mysql_audit, jsp_drop
| order by TimeGenerated desc

Sigma

title: ARTEX MySQL general_log JSP Webshell Drop
id: a3f1c7e2-5b4d-4e8a-9c21-7d6e0b1f4a01
status: experimental
description: Detects a database server process (mysqld/mariadbd) writing a .jsp file, the end state of the ARTEX/UNC7228 MySQL general_log poisoning technique, including the JSP names cl1217.jsp, f1219a.jsp and z1219.jsp reported by Google GTIG.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
    - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.initial-access
    - attack.t1190
    - attack.tool.artex
logsource:
    category: file_event
    product: linux
detection:
    selection_proc:
        Image|endswith:
            - '/mysqld'
            - '/mariadbd'
    selection_ext:
        TargetFilename|endswith: '.jsp'
    selection_known:
        TargetFilename|endswith:
            - '/cl1217.jsp'
            - '/f1219a.jsp'
            - '/z1219.jsp'
    condition: (selection_proc and selection_ext) or selection_known
falsepositives:
    - Applications that legitimately export JSP templates through MySQL INTO OUTFILE
    - Developer deployments writing JSP files from a database server host
level: high

Known false positives:

• Database administrators legitimately relocating general_log_file for troubleshooting (target should not be a .jsp or a web root)
• Backup or export jobs writing .jsp templates via INTO OUTFILE

Tuning notes: Confirm the MySQL log sourcetype names match your ingestion (Splunk Add-on for MySQL or custom inputs) and that general_log or the audit plugin is enabled on application databases. Add web-root path allowlists only if a DBA workflow requires them. Remove FILE and SUPER privileges from application accounts so the technique cannot succeed.

• 🔒 ARTEX Storm-0940 Cross-Tenant M365 Password Spray and Known Infrastructure — Initial Access · unlock with TL Creds
• 🔒 Compromised ConnectWise OAuth App Activity and Credential/Role Changes — Post-Exploitation · unlock with TL Creds
• 🔒 ARTEX Pass-the-Hash and WinRM Lateral Movement — Lateral Movement · unlock with TL Creds
• 🔒 ARTEX Kerberoasting RC4 Service Ticket Requests — Credential Access · unlock with TL Creds
• 🔒 ARTEX ArtexProbe Accounts and artex-probe Files — Persistence / Forensic Artifacts · unlock with TL Creds
• 🔒 ARTEX AWS EC2 DryRun Permission-Discovery Bursts — Cloud Discovery · unlock with TL Creds
• 🔒 ARTEX DCSync Directory Replication by Non-Machine Account — Post-Exploitation · unlock with TL Creds
• 🔒 ARTEX Automated Exfiltration to Rotating [indicator] Endpoints — C2 / Exfiltration · unlock with TL Creds

Indicators of compromise for ARTEX AI pentest framework

As of 2026-11-02, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-5032.

Sample indicators (3 of 18)

• IP address: 144.172.64[.]128
• Domain: webhook[.]site
• IP address: 144.172.64[.]99

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

How ARTEX AI pentest framework works

ARTEX is an open-source, multi-agent LLM-driven offensive framework written in Go with an embedded Next.js console (interfaces in English, Korean, Mandarin, Spanish and Japanese). It translates operator objectives into commands through six specialized sub-agents covering the attack lifecycle (reconnaissance, initial access, privilege escalation, lateral movement, persistence and exfiltration/mission completion, per Google GTIG) and can be pointed at any model; Microsoft observed configurations for DeepSeek via an OpenAI-compatible gateway, plus GLM and Grok. The original developer (GitHub handle Autumn-27) took the repository down in October 2026 (the GBHackers article dates the announcement to 8 October) citing abuse, but community forks (e.g. ScopeWeaver) and a commercial edition (ARTEX PRO) continue to circulate. Earlier ARTEX activity against South Korean financial institutions was reported by CrowdStrike, Zscaler and Recorded Future (per SecurityWeek).

Google GTIG tracks the intrusion cluster as UNC7228, active since at least August 2026 against enterprise software, industrial automation, semiconductor and telecommunications organizations in the US and Europe; the cluster overlaps with Microsoft's Storm-0940 (China state-aligned, active since at least 2021) and with a Wiz Research investigation of October 2026 intrusions at IT/software vendors. Observed tradecraft includes: Kudu/SCM administrative API abuse on Azure for command execution; mapping of effective permissions for stolen Azure SAS tokens, service principals and storage keys with sub-second test blob writes and ARM dry-run sweeps; AWS EC2/EBS/snapshot capability probing with DryRun flags (27 events in 23 seconds in one burst); SQL injection and writable is_admin flag abuse to create administrator accounts within minutes; Kerberoasting, DCSync (krbtgt, AD-sync credentials, DC hashes), AD CS template audits and enumeration of 110,000+ AD objects; Pass-the-Ticket, Pass-the-Hash, WinRM and Kerberos relay lateral movement (partly blocked by endpoint protection); SSH key generation, Elastic IP allocation and t3.micro jump hosts for persistence; and exfiltration of command output and database results to 491 rotating webhook.site endpoints via curl. JSP webshells were planted by pointing the MySQL general_log_file at a web-accessible .jsp path and logging a query containing the shell code. The fastest observed compromise took 15 minutes and deep access typically took about four hours. The framework is forensically noisy (artex-probe-NNNNN artifacts, ArtexProbe accounts, 240+ log events for a single SQL execution attempt, sub-agents overwriting one another), which is the main detection opportunity.

Microsoft attributes to Storm-0940 an ARTEX-driven campaign from September 2026: a cross-tenant Microsoft 365 password spray between 10 and 14 October 2026 (peak 2,900 failures per minute on 11 October; 151,000+ failed logons; 327 accounts across 8 organizations; 2,250+ tenants targeted) and the compromise of ConnectWise multi-tenant OAuth applications (Cloud Backup, SaaS Security, Cloud Management), whose credentials were used from 15 October for Microsoft Graph reconnaissance, application credential modification, role/group changes and data collection, with access in under three hours in several cases. Infrastructure was rotated within minutes of blocking, with sessions lasting 24-30 hours. The GBHackers article additionally lists Weaver OA, AWS, Okta, Entra ID, M365 and AWS Cognito among probed targets. No CVEs are associated with this threat; the intrusions rely on credential abuse, application flaws such as SQL injection, misconfiguration and supply-chain trust relationships.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.006 OS Credential Dumping: DCSync; T1110.003 Brute Force: Password Spraying; T1528 Steal Application Access Token; T1555 Credentials from Password Stores; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Exfiltration

T1020 Automated Exfiltration

Lateral Movement

T1021.006 Remote Services: Windows Remote Management; T1550.002 Use Alternate Authentication Material: Pass the Hash; T1550.003 Use Alternate Authentication Material: Pass the Ticket

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Discovery

T1087 Account Discovery; T1580 Cloud Infrastructure Discovery

Persistence

T1098.001 Account Manipulation: Additional Cloud Credentials; T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Privilege Escalation

T1098.003 Account Manipulation: Additional Cloud Roles

Reconnaissance

T1595 Active Scanning

Remediation for ARTEX AI pentest framework

Immediate actions

• Disable and inventory ConnectWise OAuth application connections (app IDs 506e08f9-6e9a-4da4-942b-a099a03644ae, 24205314-2b89-4e07-a2a4-579e898a5640, 0de14c77-b9b0-4137-9360-34878a929827) after preserving configuration evidence
• Review service principal sign-ins and credential/role changes from 2026-10-01 onward
• Block listed Storm-0940 IPs and alert on outbound traffic from production servers to webhook.site
• Hunt for artex-probe-* files, ArtexProbe accounts and unexpected .jsp files written by MySQL general_log
• Rotate exposed credentials, SAS tokens, storage keys and service principal secrets

Workarounds

• Disable basic publishing authentication and restrict SCM access on Azure App Service
• Remove FILE/administrative privileges from application database accounts to prevent general_log webshell writes
• Enable Google SecOps Mandiant rules: Suspicious Webhook.Site Interaction, Suspicious Curl Invocation, Cmd Launching Curl, AWS Cloud Accounts GetCallerIdentity

Longer-term hardening

• Isolate management planes (Kudu/SCM, cloud consoles, CI/CD) to trusted networks
• Move to short-lived workload credentials and managed identities; eliminate long-lived secrets
• Segment DMZ/application tiers and restrict server egress; monitor previously unseen destinations
• Apply rate limits and guardrails to high-impact application APIs and notification features
• Baseline identity authentication sources and alert on API bursts, permission-testing sequences and unusual snapshot/blob activity
• Review AD CS templates (remove ENROLLEE_SUPPLIES_SUBJECT where unneeded) and restrict iam:PassRole

Affected and fixed versions

• ConnectWise — Cloud Backup / SaaS Security / Cloud Management (multi-tenant OAuth applications)
  Vulnerable versions: Application credentials compromised October 2026
  Fixed in: Remediate per ConnectWise advisory of 2026-10-16
• Microsoft — Entra ID / Microsoft 365 / Azure App Service (Kudu)
  Vulnerable versions: Tenants with exposed OAuth app credentials, weak passwords or exposed SCM endpoints
• Amazon Web Services — EC2 / EBS / IAM / Cognito
  Vulnerable versions: Environments with exposed long-lived keys or permissive iam:PassRole
• Okta — Okta identity provider
  Vulnerable versions: Probed per GBHackers reporting
• Weaver (Fanwei) — Weaver OA server
  Vulnerable versions: Targeted per GBHackers reporting; version not stated
• Oracle — MySQL (general_log webshell technique)
  Vulnerable versions: Instances where application accounts can set global general_log settings
• Microsoft — Active Directory / AD CS
  Vulnerable versions: Domains exposed to Kerberoasting, DCSync and permissive AD CS templates

Timeline of ARTEX AI pentest framework

• 2026-08-01 Late August 2026 (month-level date): Google GTIG observes UNC7228 using locked-ioc-18 against software, industrial automation, semiconductor and telecom targets in the US and Europe.
• 2026-09-01 Early September 2026 (month-level date): Microsoft assesses Storm-0940 began using locked-ioc-18; earlier locked-ioc-18 use against South Korean financial institutions was reported by CrowdStrike, Zscaler and Recorded Future.
• 2026-10-08 locked-ioc-18 developer announces closure and discontinued maintenance (per GBHackers); original repository removed, forks such as locked-ioc-12 and locked-ioc-16 persist.
• 2026-10-10 Storm-0940 begins a cross-tenant Microsoft 365 password-spray campaign driven by locked-ioc-18.
• 2026-10-11 Spray peaks at 2,900 failed logons per minute (111,000+ failures in the single day).
• 2026-10-14 Password-spray window ends after 151,000+ failed logon events, 327 accounts across 8 organizations and 2,250+ tenants targeted.
• 2026-10-15 locked-ioc-18 agents obtain ConnectWise cloud application credentials; ConnectWise supply-chain compromise disclosed.
• 2026-10-16 ConnectWise publishes an advisory on the compromise of its multi-tenant OAuth applications.
• 2026-10-21 Microsoft Threat Intelligence publishes its Storm-0940 / locked-ioc-18 report with IOCs and hunting guidance.
• 2026-11-02 GBHackers reports locked-ioc-18 weaponization by UNC7228, citing Google GTIG, Wiz and Microsoft research.

Sources cited for ARTEX AI pentest framework

• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Microsoft Threat Intelligence) Microsoft · Vendor report · 2026-10-21
• ARTEX and Friends: Enter Agentic Offensive Frameworks (Google Threat Intelligence Group) Google Cloud · Research
• Microsoft Threat Intelligence post on Storm-0940 use of ARTEX (X) x.com · Vendor report
• Storm-0940 and ARTEX: the AI-driven ConnectWise attack (Hard2bit) hard2bit.com · Blog
• ARTEX: Agentic Pentest Framework Used in Real Attacks (Sesame Disk) sesamedisk.com · Blog
• Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data (GBHackers) gbhackers.com · News · 2026-11-02
• China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack (The Hacker News) The Hacker News · News
• China APT Uses AI Pentest Tool Artex in ConnectWise Attacks (SecurityWeek) SecurityWeek · News

More in apt

• APT SideWinder Domain Infrastructure Targeting South Asian Governments (CVE-2017-0199 Weaponized Documents)
• Suspected APT37 Python Backdoor Delivered via AI Deepfake Impersonation Spear-Phishing Campaign
• MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns Targeting the Middle East and Global Organizations
• CISA AA26-194A: Russian State-Sponsored (FSB Center 16) Exploitation of Misconfigured Cisco Routers via SNMP and Smart Install (CVE-2018-0171, CVE-2008-4128)
• APT and Financial Attacks on Industrial Organizations in Q1 2026 (Kaspersky ICS CERT): Operation Neusploit (CVE-2026-21509/CVE-2026-21513), Poland Energy Wipers, TGR-STA-1030, MuddyWater, LockBit 5.0, Diesel Vortex