# ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data Theft

> ARTEX, an open-source Go-based multi-agent LLM penetration-testing framework, has been used in the wild since late August 2026 to automate AD reconnaissance, cloud permission discovery, credential theft, JSP webshell deployment via MySQL log poisoning and data extraction. Google GTIG tracks the activity as UNC7228 and Microsoft as the China state-aligned Storm-0940, which also used ARTEX for mass password spraying and the October 2026 ConnectWise OAuth-application compromise.

- **Published:** 2026-11-02T05:45:16Z
- **Last reviewed:** 2026-11-02T05:45:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5032
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5032.png
- **ID:** TL-2026-5032
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** UNC7228 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 18 (3 shown free below)

## Description

ARTEX is an open-source, multi-agent LLM-driven offensive framework written in Go with an embedded Next.js console (interfaces in English, Korean, Mandarin, Spanish and Japanese). It translates operator objectives into commands through six specialized sub-agents covering the attack lifecycle (reconnaissance, initial access, privilege escalation, lateral movement, persistence and exfiltration/mission completion, per Google GTIG) and can be pointed at any model; Microsoft observed configurations for DeepSeek via an OpenAI-compatible gateway, plus GLM and Grok. The original developer (GitHub handle Autumn-27) took the repository down in October 2026 (the GBHackers article dates the announcement to 8 October) citing abuse, but community forks (e.g. ScopeWeaver) and a commercial edition (ARTEX PRO) continue to circulate. Earlier ARTEX activity against South Korean financial institutions was reported by CrowdStrike, Zscaler and Recorded Future (per SecurityWeek).

Google GTIG tracks the intrusion cluster as UNC7228, active since at least August 2026 against enterprise software, industrial automation, semiconductor and telecommunications organizations in the US and Europe; the cluster overlaps with Microsoft's Storm-0940 (China state-aligned, active since at least 2021) and with a Wiz Research investigation of October 2026 intrusions at IT/software vendors. Observed tradecraft includes: Kudu/SCM administrative API abuse on Azure for command execution; mapping of effective permissions for stolen Azure SAS tokens, service principals and storage keys with sub-second test blob writes and ARM dry-run sweeps; AWS EC2/EBS/snapshot capability probing with DryRun flags (27 events in 23 seconds in one burst); SQL injection and writable is_admin flag abuse to create administrator accounts within minutes; Kerberoasting, DCSync (krbtgt, AD-sync credentials, DC hashes), AD CS template audits and enumeration of 110,000+ AD objects; Pass-the-Ticket, Pass-the-Hash, WinRM and Kerberos relay lateral movement (partly blocked by endpoint protection); SSH key generation, Elastic IP allocation and t3.micro jump hosts for persistence; and exfiltration of command output and database results to 491 rotating webhook.site endpoints via curl. JSP webshells were planted by pointing the MySQL general_log_file at a web-accessible .jsp path and logging a query containing the shell code. The fastest observed compromise took 15 minutes and deep access typically took about four hours. The framework is forensically noisy (artex-probe-NNNNN artifacts, ArtexProbe accounts, 240+ log events for a single SQL execution attempt, sub-agents overwriting one another), which is the main detection opportunity.

Microsoft attributes to Storm-0940 an ARTEX-driven campaign from September 2026: a cross-tenant Microsoft 365 password spray between 10 and 14 October 2026 (peak 2,900 failures per minute on 11 October; 151,000+ failed logons; 327 accounts across 8 organizations; 2,250+ tenants targeted) and the compromise of ConnectWise multi-tenant OAuth applications (Cloud Backup, SaaS Security, Cloud Management), whose credentials were used from 15 October for Microsoft Graph reconnaissance, application credential modification, role/group changes and data collection, with access in under three hours in several cases. Infrastructure was rotated within minutes of blocking, with sessions lasting 24-30 hours. The GBHackers article additionally lists Weaver OA, AWS, Okta, Entra ID, M365 and AWS Cognito among probed targets. No CVEs are associated with this threat; the intrusions rely on credential abuse, application flaws such as SQL injection, misconfiguration and supply-chain trust relationships.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1078.004 Valid Accounts: Cloud Accounts
- T1110.003 Brute Force: Password Spraying
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1003.006 OS Credential Dumping: DCSync
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1580 Cloud Infrastructure Discovery
- T1098.001 Account Manipulation: Additional Cloud Credentials
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1098.003 Account Manipulation: Additional Cloud Roles
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1550.003 Use Alternate Authentication Material: Pass the Ticket
- T1021.006 Remote Services: Windows Remote Management
- T1020 Automated Exfiltration

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ARTEX MySQL general_log JSP Webshell Poisoning (UNC7228 / Storm-0940) — Exploitation** (`TL-2026-5032-SPL-001`)

Detects the ARTEX/UNC7228 technique of abusing SQL injection plus FILE/SUPER privileges to repoint MySQL general_log_file at a web-accessible .jsp path and log a query containing JSP shell code, producing an ephemeral webshell (cl1217.jsp, f1219a.jsp, z1219.jsp observed by Google GTIG). Covers the SQL-level indicator (SPL/KQL) and the resulting file write by the database process (KQL/Sigma).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1505.003
- **Data sources:** mysql:generalQueryLog, mysql:auditLog, AzureDiagnostics (MySqlAuditLogs), DeviceFileEvents, linux file_event
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=database (sourcetype="mysql:generalQueryLog" OR sourcetype="mysql:auditLog" OR sourcetype="mysql:queryLog") earliest=-24h "general_log_file" ".jsp"
```ARTEX MySQL log poisoning: SET GLOBAL general_log_file pointed at a web-accessible .jsp, then a query carrying the JSP shell code is logged into it```
| rex field=_raw "(?i)general_log_file\s*=\s*[\x27\x22]?(?<log_path>[^\x27\x22\s;]+\.jsp)"
| where isnotnull(log_path)
| eval known_artex_shell=if(match(log_path,"(?i)(cl1217|f1219a|z1219)\.jsp$"),"yes","no")
| stats count as events min(_time) as first_seen max(_time) as last_seen values(log_path) as webshell_path values(known_artex_shell) as known_artex_shell values(user) as db_user values(src) as src_host by host
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - events
````

### Microsoft KQL

```kql
let mysql_audit = AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceProvider == "MICROSOFT.DBFORMYSQL" and Category == "MySqlAuditLogs"
    | where sql_text_s has "general_log_file" and sql_text_s has ".jsp"
    | project TimeGenerated, Host = Resource, Actor = event_class_s, Detail = sql_text_s, Signal = "MySQL general_log_file set to .jsp";
let jsp_drop = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("FileCreated", "FileModified")
    | where InitiatingProcessFileName in~ ("mysqld", "mysqld.exe", "mariadbd", "mariadbd.exe")
    | where FileName endswith ".jsp"
    | project TimeGenerated = Timestamp, Host = DeviceName, Actor = InitiatingProcessAccountName, Detail = FolderPath, KnownArtexShell = FileName in~ ("cl1217.jsp", "f1219a.jsp", "z1219.jsp"), Signal = "JSP file written by database server process";
union isfuzzy=true mysql_audit, jsp_drop
| order by TimeGenerated desc
```

### Sigma

```yaml
title: ARTEX MySQL general_log JSP Webshell Drop
id: a3f1c7e2-5b4d-4e8a-9c21-7d6e0b1f4a01
status: experimental
description: Detects a database server process (mysqld/mariadbd) writing a .jsp file, the end state of the ARTEX/UNC7228 MySQL general_log poisoning technique, including the JSP names cl1217.jsp, f1219a.jsp and z1219.jsp reported by Google GTIG.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
    - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/02
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.initial-access
    - attack.t1190
    - attack.tool.artex
logsource:
    category: file_event
    product: linux
detection:
    selection_proc:
        Image|endswith:
            - '/mysqld'
            - '/mariadbd'
    selection_ext:
        TargetFilename|endswith: '.jsp'
    selection_known:
        TargetFilename|endswith:
            - '/cl1217.jsp'
            - '/f1219a.jsp'
            - '/z1219.jsp'
    condition: (selection_proc and selection_ext) or selection_known
falsepositives:
    - Applications that legitimately export JSP templates through MySQL INTO OUTFILE
    - Developer deployments writing JSP files from a database server host
level: high

```

**Known false positives:**

- Database administrators legitimately relocating general_log_file for troubleshooting (target should not be a .jsp or a web root)
- Backup or export jobs writing .jsp templates via INTO OUTFILE

**Tuning notes:** Confirm the MySQL log sourcetype names match your ingestion (Splunk Add-on for MySQL or custom inputs) and that general_log or the audit plugin is enabled on application databases. Add web-root path allowlists only if a DBA workflow requires them. Remove FILE and SUPER privileges from application accounts so the technique cannot succeed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ARTEX Storm-0940 Cross-Tenant M365 Password Spray and Known Infrastructure — Initial Access (locked: unlock with TL Creds)
- Compromised ConnectWise OAuth App Activity and Credential/Role Changes — Post-Exploitation (locked: unlock with TL Creds)
- ARTEX Pass-the-Hash and WinRM Lateral Movement — Lateral Movement (locked: unlock with TL Creds)
- ARTEX Kerberoasting RC4 Service Ticket Requests — Credential Access (locked: unlock with TL Creds)
- ARTEX ArtexProbe Accounts and artex-probe Files — Persistence / Forensic Artifacts (locked: unlock with TL Creds)
- ARTEX AWS EC2 DryRun Permission-Discovery Bursts — Cloud Discovery (locked: unlock with TL Creds)
- ARTEX DCSync Directory Replication by Non-Machine Account — Post-Exploitation (locked: unlock with TL Creds)
- ARTEX Automated Exfiltration to Rotating [indicator] Endpoints — C2 / Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 18)

Defanged, TLP:CLEAR.

- IP address: `144.172.64[.]128`
- Domain: `webhook[.]site`
- IP address: `144.172.64[.]99`

Full set of 18 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data (GBHackers)](https://gbhackers.com/artex-ai-agents/)
- [AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Microsoft Threat Intelligence)](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)
- [ARTEX and Friends: Enter Agentic Offensive Frameworks (Google Threat Intelligence Group)](https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks)
- [China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack (The Hacker News)](https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html)
- [China APT Uses AI Pentest Tool Artex in ConnectWise Attacks (SecurityWeek)](https://www.securityweek.com/china-apt-uses-ai-pentest-tool-artex-in-connectwise-attacks/)
- [Microsoft Threat Intelligence post on Storm-0940 use of ARTEX (X)](https://x.com/MsftSecIntel/status/2112975078266716390)
- [Storm-0940 and ARTEX: the AI-driven ConnectWise attack (Hard2bit)](https://hard2bit.com/en/blog/storm-0940-artex-connectwise-ai-attack-microsoft-365/)
- [ARTEX: Agentic Pentest Framework Used in Real Attacks (Sesame Disk)](https://sesamedisk.com/artex-agentic-pentest-framework-attacks/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5032