ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions

Key facts for ARTEX agentic intrusion campaigns

Detection coverage for ARTEX agentic intrusion campaigns

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5196 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX Storm-0940 Entra ID Password Spray - High-Velocity Multi-User Failures per Source IP

Detects the machine-speed cross-tenant password spray used by Storm-0940 with the ARTEX agentic framework (10-14 Oct 2026: 327 accounts, 151,000+ failed sign-ins, peak ~2,900 failures/minute). Fires when one source IP produces failed Entra ID sign-ins (50126 invalid password, 50053 locked, 50034 unknown user) against 10+ distinct accounts with 30+ failures inside one minute, or when the source matches Storm-0940 / Wiz-observed ARTEX infrastructure (144.172.64.99, 144.172.64.128, 144.172.64.60, 187.15.x.x VPN IPs, 104.194.150.21, 167.88.172.97). Behaviour-first so it survives IP rotation and user-agent cycling.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1110.003, T1078.004
• Data sources: azure:aad:signin, SigninLogs, azure signinlogs
• Severity: high
• Confidence: high

Splunk SPL

index=azure sourcetype="azure:aad:signin" earliest=-60m
| eval src_ip='properties.ipAddress', upn='properties.userPrincipalName', err=tonumber('properties.status.errorCode')
| where err=50126 OR err=50053 OR err=50034
| bin _time span=1m
| stats count AS failures dc(upn) AS distinct_users values(upn) AS sample_users BY src_ip, _time
| eval ioc_match=if(in(src_ip,"144.172.64.99","144.172.64.128","144.172.64.60","187.15.88.186","187.15.90.217","187.15.89.186","104.194.150.21","167.88.172.97"),1,0)
| where (distinct_users>=10 AND failures>=30) OR ioc_match=1
| table _time src_ip failures distinct_users ioc_match sample_users

Microsoft KQL

let actorIps = dynamic(['144.172.64.99','144.172.64.128','144.172.64.60','187.15.88.186','187.15.90.217','187.15.89.186','104.194.150.21','167.88.172.97']);
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType in ('50126','50053','50034')
| summarize Failures=count(), DistinctUsers=dcount(UserPrincipalName), SampleUsers=make_set(UserPrincipalName, 5), UserAgents=dcount(UserAgent) by IPAddress, bin(TimeGenerated, 1m)
| extend KnownActorIP = IPAddress in (actorIps)
| where (DistinctUsers >= 10 and Failures >= 30) or KnownActorIP
| project TimeGenerated, IPAddress, Failures, DistinctUsers, UserAgents, KnownActorIP, SampleUsers

Sigma

title: Entra ID Failed Sign-in Base Event for Password Spray Correlation
name: artex_entra_failed_signin
id: 3a6f1c2e-8d4b-4e57-9b0a-2f7c5d1e9a41
status: experimental
description: Failed Entra ID sign-in (invalid password, locked account, unknown user). Base event for the ARTEX / Storm-0940 password spray correlation rule.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.credential-access
    - attack.t1110.003
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType:
            - 50126
            - 50053
            - 50034
    condition: selection
falsepositives:
    - Individual users mistyping passwords
level: low
---
title: Entra ID Password Spray - Many Distinct Accounts Failing From One Source (ARTEX Storm-0940)
id: 9e2b7d44-1c63-4a8f-b5d0-6a3e8f12c7b9
status: experimental
description: One source IP failing Entra ID authentication for 10 or more distinct accounts within one minute, matching the machine-speed ARTEX password spray attributed to Storm-0940.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
    - https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.credential-access
    - attack.t1110.003
    - attack.initial-access
    - attack.t1078.004
correlation:
    type: value_count
    rules:
        - artex_entra_failed_signin
    group-by:
        - IPAddress
    timespan: 1m
    condition:
        gte: 10
        field: UserPrincipalName
falsepositives:
    - Corporate NAT or proxy egress where many users share one IP after a password policy change
    - Vulnerability scanners or red-team password-audit exercises
level: high

Known false positives:

• Corporate NAT/proxy egress IP where many users fail sign-in simultaneously (e.g. after a password expiry wave or an SSO outage)
• Authorized red-team or password-audit tooling run from a known IP

Tuning notes: Exclude corporate egress and VPN IPs with a lookup. Lower the thresholds (distinct_users>=5, failures>=15) for low-volume tenants; raise them for large NAT'd sites. The IOC IP list is supplementary: ARTEX rotates IPs and user agents, so keep the volume/distinct-user logic as the primary trigger. Confirm the field names (properties.status.errorCode, properties.ipAddress) against your Splunk Add-on for Microsoft Cloud Services version.

• 🔒 Abused ConnectWise Cloud Backup / Cloud Management Application Identity Sign-ins · unlock with TL Creds
• 🔒 Bulk Azure Key Vault Secret Reads by Abused Application or Storm-0940 Source · unlock with TL Creds
• 🔒 Kerberoasting (RC4 TGS Bursts) and DCSync Replication Requests From Non-DC Accounts · unlock with TL Creds
• 🔒 Web Server Process Spawning Shell or Recon Utility (VAPOR PANDA JSP/PHP Web Shell) · unlock with TL Creds
• 🔒 BLOODALCHEMY DLL Side-Loading via Renamed GameHook svchost.exe · unlock with TL Creds
• 🔒 WinRM Remote Command Execution Chain via wsmprovhost.exe (ARTEX Lateral Movement) · unlock with TL Creds
• 🔒 ARTEX Cloud Privilege Escalation - Global Administrator Self-Assignment and Credential Addition to Service Principals · unlock with TL Creds
• 🔒 VAPOR PANDA C2 Infrastructure and Chisel / SoftEther Tunneling on Endpoints · unlock with TL Creds

Indicators of compromise for ARTEX agentic intrusion campaigns

As of 2026-11-04, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-5196.

Sample indicators (3 of 28)

• IP address: 144.172.64[.]128
• Domain: nginxmysql[.]com
• File hash: 49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

How ARTEX agentic intrusion campaigns works

Machine-speed, identity-centric tradecraft shortens the window between first access and privileged control to under three hours.

ARTEX is an open-source, multi-agent LLM offensive framework written in Go with a Next.js frontend and a UI available in English, Korean, Mandarin, Spanish and Japanese. A main agent coordinates planner and worker agents (reconnaissance, vulnerability discovery, exploitation, exfiltration and credential-search agents) that share a graph of assets, findings and goals, and results are written to a database and turned into structured reports. It accepts any OpenAI-compatible model endpoint; observed deployments used DeepSeek as the primary model, with GLM and Grok also appearing in configurations (per CSA and Zscaler-derived reporting cited by The Hacker News). It was released publicly on GitHub in July 2026. After abuse became public its developer withdrew the original repository and moved to closed source in October 2026, but copies and forks remain in circulation. Much of what is known about the framework comes from operator mistakes: exposed directories containing session histories, configuration files and memory dumps.

Storm-0940 (China state-aligned, active since 2021 per Microsoft) used ARTEX from September 2026 against hundreds of organizations in aerospace, defense, energy, financial services, government, manufacturing and technology. Microsoft reports a password-spray campaign on 10-14 October 2026 against 327 accounts at 8 organizations, with 151,000+ failed sign-ins, a peak of roughly 2,900 failures per minute and about 111,000 failures on 11 October. The actor then abused compromised ConnectWise Cloud Backup (formerly SkyKick) OAuth application identities to attempt authentication to 2,250+ Microsoft 365 tenants, reaching privileged cloud access in under three hours in multiple cases and obtaining 200+ successful sign-ins in under four minutes using four application credentials. Post-access behavior included self-assignment of Global Administrator, Microsoft Graph API data access, Key Vault secret reads and notification features abused to message 1,300+ internal users. Wiz separately observed ARTEX-style activity against software/IT companies and identity providers (Entra ID, Okta, Amazon Cognito): source-map and Swagger/OpenAPI harvesting, OAuth callback and state manipulation, unsigned-JWT testing, Cognito API enumeration, 1-second median spray gaps, rapid IP rotation and user-agent cycling.

VAPOR PANDA (China-nexus; CrowdStrike, 29 October 2026) ran ARTEX from 17 October 2026 against 200+ organizations in 14+ countries over an 11-day window, with confirmed post-exploitation at 9 organizations. CrowdStrike assesses this as separate from Storm-0940 activity. Operator instructions in Chinese, timestamped in China Standard Time, directed agents to write web shells, extract domain administrator passwords, find Windows hosts without CrowdStrike Falcon sensors and pursue multiple attack paths in parallel; roughly 1.4 billion input tokens were consumed in a single intrusion. Initial access used SAML validation flaws plus XXE, leaked VPN credentials and configurations, and unauthenticated orchestration services; escalation used resource-based constrained delegation, cloud IMDS abuse, LAPS password theft and forged SAML/admin tokens. Persistence used JSP/PHP web shells and BLOODALCHEMY, delivered by a legitimate GameHook binary renamed svchost.exe that side-loads graphics-hook-filter64.dll, which decrypts graphics-hook_config.bin. C2 tunneling used Chisel and SoftEther with multi-hop proxies (Tor, SOCKS, compromised relays).

The secondary source (Cyber Security News, 3 November 2026) additionally lists Kerberoasting, DCSync, WinRM/SMB lateral movement, new administrator account creation and bulk cloud secret retrieval as ARTEX-driven behaviors; these were not independently confirmed in the primary reports fetched. No CVEs are attributed. The core defensive challenge is that ARTEX runs ordinary administrative tooling with legitimate credentials at 2-25 second action cadences, so detections must correlate sequences of events across identity, directory and cloud-control-plane logs rather than rely on artifacts such as 'artx'/'artex' strings, which operators can change. BeaconBeagle lookups for the network IOCs returned HTTP 502 at research time, so no C2 correlation was obtained.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.006 DCSync; T1110.003 Password Spraying; T1528 Steal Application Access Token; T1552.005 Cloud Instance Metadata API; T1555.006 Cloud Secrets Management Stores; T1558.003 Kerberoasting; T1606.002 SAML Tokens

Lateral Movement

T1021.002 SMB/Windows Admin Shares; T1021.006 Windows Remote Management

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1574.001 DLL

Initial Access

T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Discovery

T1087.004 Cloud Account; T1580 Cloud Infrastructure Discovery

Command and Control

T1090 Proxy; T1572 Protocol Tunneling

Persistence

T1098.001 Additional Cloud Credentials; T1505.003 Web Shell

Privilege Escalation

T1098.003 Additional Cloud Roles

Collection

T1114.002 Remote Email Collection

Reconnaissance

T1595 Active Scanning

Remediation for ARTEX agentic intrusion campaigns

Patches

• Patch internet-facing appliances and keep firmware current; apply ConnectWise guidance from its trust advisories

Immediate actions

• Inventory and disable ConnectWise Cloud Backup / Cloud Management app connections (506e08f9-6e9a-4da4-942b-a099a03644ae, 24205314-2b89-4e07-a2a4-579e898a5640, 0de14c77-b9b0-4137-9360-34878a929827) pending vendor restoration; preserve enterprise application evidence before deletion
• Block 144.172.64.128, 144.172.64.99, 144.172.64.60 and the VAPOR PANDA C2 IPs/domains; review sign-ins and Graph/Key Vault/Storage/ARM activity from them
• Review service-principal sign-ins from 2026-10-01 (at minimum 2026-10-15) for new credentials, owners, consent grants and privileged role assignments
• Rotate signing keys, pre-authentication keys and service credentials where exposure is suspected

Workarounds

• Apply least privilege to multi-tenant application permissions
• Hunt for ARTEX markers (artx/artex parameters, artx-prefixed cloud roles, art18- comments, C:\ProgramData\artx5v\, artex-probe-* files) as supplementary evidence only

Longer-term hardening

• Inventory non-human identities (service principals, OAuth apps, workload identities) with owner, permissions and expected sign-in sources
• Build correlation detections for high-velocity sequences (unfamiliar auth, enumeration, credential modification, sensitive data access) instead of single-event rules
• Audit AD for Kerberoasting (Event 4769), DCSync (Event 4662) and unexpected WinRM/SMB between isolated systems
• Monitor egress for unauthorized LLM API and reseller endpoint calls
• Deploy EDR on all endpoints and enforce IMDSv2 and SAML signature validation

Affected and fixed versions

• ConnectWise — Cloud Backup (formerly SkyKick) and Cloud Management OAuth applications
• Microsoft — Microsoft 365 / Entra ID / Azure
• Okta — Okta Identity Platform
• Amazon Web Services — AWS / Amazon Cognito
• Microsoft — Active Directory / Windows domain environments

Timeline of ARTEX agentic intrusion campaigns

• 2026-07-01 locked-ioc-28 is released publicly on GitHub in July 2026 (exact day not stated in sources) as an open-source multi-agent LLM penetration-testing framework.
• 2026-09-01 Per Microsoft, Storm-0940 begins using locked-ioc-28 as early as September 2026 (month-level date) against hundreds of organizations globally.
• 2026-10-10 Automated cross-tenant password spray starts against 327 accounts at 8 organizations; it continues through 14 October with 151,000+ failed sign-ins.
• 2026-10-11 Spray peaks at about 2,900 failures per minute and roughly 111,000 failures in one day.
• 2026-10-15 Compromise of ConnectWise Cloud Backup application identities is disclosed; downstream attempts against 2,250+ Microsoft 365 tenants follow, with privileged access in under three hours in multiple cases.
• 2026-10-16 ConnectWise publishes an advisory on the application identity compromise (date per Microsoft's timeline).
• 2026-10-17 VAPOR PANDA begins an 11-day ARTEX-driven campaign against 200+ organizations in 14+ countries, with confirmed post-exploitation at 9 organizations.
• 2026-10-21 Microsoft Threat Intelligence publishes its analysis attributing the ConnectWise supply chain compromise to Storm-0940 using locked-ioc-28.
• 2026-10-28 VAPOR PANDA campaign window ends; CSA publishes a research note on locked-ioc-28 and CyberStrikeAI the same day.
• 2026-10-29 CrowdStrike publishes its VAPOR PANDA report, documenting locked-ioc-25 delivery and locked-ioc-28 operator instructions.
• 2026-10-30 Google Threat Intelligence Group / Mandiant research on locked-ioc-28 abuse is reported (as cited by the secondary source; primary report not retrieved).
• 2026-11-03 Cyber Security News publishes defender guidance; the original locked-ioc-28 repository has by then been withdrawn by its creator (October 2026) while forks continue to circulate.

Sources cited for ARTEX agentic intrusion campaigns

• ConnectWise Trust Advisories connectwise.com · Advisory · 2026-10-16
• Microsoft: Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise Microsoft · Vendor report · 2026-10-21
• CrowdStrike: VAPOR PANDA uses ARTEX to scale global campaign CrowdStrike · Vendor report · 2026-10-29
• Wiz: ARTEX in the wild - Storm-0940 expands targeting of IT and software vendors Wiz · Research
• Cloud Security Alliance: Multi-Agent Offensive Frameworks in the Wild - CyberStrikeAI and ARTEX labs.cloudsecurityalliance.org · Research · 2026-10-28
• Hackers Use ARTEX AI to Automate Enterprise Attacks at Machine Speed - Insights for Defenders cybersecuritynews.com · News · 2026-11-03
• The Hacker News: China-linked hackers use ARTEX AI The Hacker News · News
• Cyber Security News: Hackers use ARTEX AI agents (Google Threat Intelligence Group / Mandiant coverage) cybersecuritynews.com · News · 2026-10-30
• Dark Reading: Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack Dark Reading · News
• The Record: China cyber ConnectWise AI The Record · News

More in apt

• APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)
• Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)
• Kimsuky (APT43) Dot-Padded LNK Spear-Phishing Tradecraft: Detection and Exploitation Analysis
• TraderTraitor (North Korea) months-long campaign leads to $6.34B Binance cryptocurrency theft
• AI agent frameworks ARTEX (Vapor Panda, Storm-0940) and CyberStrikeAI scale China-linked intrusion campaigns