# ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions > ARTEX, an open-source multi-agent LLM penetration-testing framework (Go backend, Next.js UI), was used in October 2026 by Storm-0940 against 2,250+ Microsoft 365 tenants via compromised ConnectWise Cloud Backup application identities, and by VAPOR PANDA against 200+ organizations in 14+ countries with the BLOODALCHEMY backdoor. Machine-speed, identity-centric tradecraft shortens the window between first access and privileged control to under three hours. - **Published:** 2026-11-04T01:31:35Z - **Last reviewed:** 2026-11-04T01:31:35Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5196 - **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5196.png - **ID:** TL-2026-5196 - **Severity:** HIGH - **Category:** APT - **Status:** ACTIVE - **Actor:** Storm-0940 (China) - **Detections:** 9 (1 shown free below) · **IOCs:** 28 (3 shown free below) ## Description ARTEX is an open-source, multi-agent LLM offensive framework written in Go with a Next.js frontend and a UI available in English, Korean, Mandarin, Spanish and Japanese. A main agent coordinates planner and worker agents (reconnaissance, vulnerability discovery, exploitation, exfiltration and credential-search agents) that share a graph of assets, findings and goals, and results are written to a database and turned into structured reports. It accepts any OpenAI-compatible model endpoint; observed deployments used DeepSeek as the primary model, with GLM and Grok also appearing in configurations (per CSA and Zscaler-derived reporting cited by The Hacker News). It was released publicly on GitHub in July 2026. After abuse became public its developer withdrew the original repository and moved to closed source in October 2026, but copies and forks remain in circulation. Much of what is known about the framework comes from operator mistakes: exposed directories containing session histories, configuration files and memory dumps. Storm-0940 (China state-aligned, active since 2021 per Microsoft) used ARTEX from September 2026 against hundreds of organizations in aerospace, defense, energy, financial services, government, manufacturing and technology. Microsoft reports a password-spray campaign on 10-14 October 2026 against 327 accounts at 8 organizations, with 151,000+ failed sign-ins, a peak of roughly 2,900 failures per minute and about 111,000 failures on 11 October. The actor then abused compromised ConnectWise Cloud Backup (formerly SkyKick) OAuth application identities to attempt authentication to 2,250+ Microsoft 365 tenants, reaching privileged cloud access in under three hours in multiple cases and obtaining 200+ successful sign-ins in under four minutes using four application credentials. Post-access behavior included self-assignment of Global Administrator, Microsoft Graph API data access, Key Vault secret reads and notification features abused to message 1,300+ internal users. Wiz separately observed ARTEX-style activity against software/IT companies and identity providers (Entra ID, Okta, Amazon Cognito): source-map and Swagger/OpenAPI harvesting, OAuth callback and state manipulation, unsigned-JWT testing, Cognito API enumeration, 1-second median spray gaps, rapid IP rotation and user-agent cycling. VAPOR PANDA (China-nexus; CrowdStrike, 29 October 2026) ran ARTEX from 17 October 2026 against 200+ organizations in 14+ countries over an 11-day window, with confirmed post-exploitation at 9 organizations. CrowdStrike assesses this as separate from Storm-0940 activity. Operator instructions in Chinese, timestamped in China Standard Time, directed agents to write web shells, extract domain administrator passwords, find Windows hosts without CrowdStrike Falcon sensors and pursue multiple attack paths in parallel; roughly 1.4 billion input tokens were consumed in a single intrusion. Initial access used SAML validation flaws plus XXE, leaked VPN credentials and configurations, and unauthenticated orchestration services; escalation used resource-based constrained delegation, cloud IMDS abuse, LAPS password theft and forged SAML/admin tokens. Persistence used JSP/PHP web shells and BLOODALCHEMY, delivered by a legitimate GameHook binary renamed svchost.exe that side-loads graphics-hook-filter64.dll, which decrypts graphics-hook_config.bin. C2 tunneling used Chisel and SoftEther with multi-hop proxies (Tor, SOCKS, compromised relays). The secondary source (Cyber Security News, 3 November 2026) additionally lists Kerberoasting, DCSync, WinRM/SMB lateral movement, new administrator account creation and bulk cloud secret retrieval as ARTEX-driven behaviors; these were not independently confirmed in the primary reports fetched. No CVEs are attributed. The core defensive challenge is that ARTEX runs ordinary administrative tooling with legitimate credentials at 2-25 second action cadences, so detections must correlate sequences of events across identity, directory and cloud-control-plane logs rather than rely on artifacts such as 'artx'/'artex' strings, which operators can change. BeaconBeagle lookups for the network IOCs returned HTTP 502 at research time, so no C2 correlation was obtained. ## MITRE ATT&CK - T1595 Active Scanning - T1195 Supply Chain Compromise - T1199 Trusted Relationship - T1078.004 Cloud Accounts - T1190 Exploit Public-Facing Application - T1110.003 Password Spraying - T1528 Steal Application Access Token - T1555.006 Cloud Secrets Management Stores - T1606.002 SAML Tokens - T1558.003 Kerberoasting - T1003.006 DCSync - T1552.005 Cloud Instance Metadata API - T1098.001 Additional Cloud Credentials - T1098.003 Additional Cloud Roles - T1505.003 Web Shell - T1574.001 DLL - T1036.005 Match Legitimate Resource Name or Location - T1087.004 Cloud Account - T1580 Cloud Infrastructure Discovery - T1021.006 Windows Remote Management - T1021.002 SMB/Windows Admin Shares - T1114.002 Remote Email Collection - T1572 Protocol Tunneling - T1090 Proxy ## Free detection (Splunk SPL, Microsoft KQL, Sigma) **ARTEX Storm-0940 Entra ID Password Spray - High-Velocity Multi-User Failures per Source IP** (`TL-2026-5196-SPL-001`) Detects the machine-speed cross-tenant password spray used by Storm-0940 with the ARTEX agentic framework (10-14 Oct 2026: 327 accounts, 151,000+ failed sign-ins, peak ~2,900 failures/minute). Fires when one source IP produces failed Entra ID sign-ins (50126 invalid password, 50053 locked, 50034 unknown user) against 10+ distinct accounts with 30+ failures inside one minute, or when the source matches Storm-0940 / Wiz-observed ARTEX infrastructure (144.172.64.99, 144.172.64.128, 144.172.64.60, 187.15.x.x VPN IPs, 104.194.150.21, 167.88.172.97). Behaviour-first so it survives IP rotation and user-agent cycling. - **Languages:** Splunk SPL, Microsoft KQL, Sigma - **ATT&CK:** T1110.003, T1078.004 - **Data sources:** azure:aad:signin, SigninLogs, azure signinlogs - **Severity:** high - **Confidence:** high ### Splunk SPL ```spl index=azure sourcetype="azure:aad:signin" earliest=-60m | eval src_ip='properties.ipAddress', upn='properties.userPrincipalName', err=tonumber('properties.status.errorCode') | where err=50126 OR err=50053 OR err=50034 | bin _time span=1m | stats count AS failures dc(upn) AS distinct_users values(upn) AS sample_users BY src_ip, _time | eval ioc_match=if(in(src_ip,"144.172.64.99","144.172.64.128","144.172.64.60","187.15.88.186","187.15.90.217","187.15.89.186","104.194.150.21","167.88.172.97"),1,0) | where (distinct_users>=10 AND failures>=30) OR ioc_match=1 | table _time src_ip failures distinct_users ioc_match sample_users ``` ### Microsoft KQL ```kql let actorIps = dynamic(['144.172.64.99','144.172.64.128','144.172.64.60','187.15.88.186','187.15.90.217','187.15.89.186','104.194.150.21','167.88.172.97']); SigninLogs | where TimeGenerated > ago(1h) | where ResultType in ('50126','50053','50034') | summarize Failures=count(), DistinctUsers=dcount(UserPrincipalName), SampleUsers=make_set(UserPrincipalName, 5), UserAgents=dcount(UserAgent) by IPAddress, bin(TimeGenerated, 1m) | extend KnownActorIP = IPAddress in (actorIps) | where (DistinctUsers >= 10 and Failures >= 30) or KnownActorIP | project TimeGenerated, IPAddress, Failures, DistinctUsers, UserAgents, KnownActorIP, SampleUsers ``` ### Sigma ```yaml title: Entra ID Failed Sign-in Base Event for Password Spray Correlation name: artex_entra_failed_signin id: 3a6f1c2e-8d4b-4e57-9b0a-2f7c5d1e9a41 status: experimental description: Failed Entra ID sign-in (invalid password, locked account, unknown user). Base event for the ARTEX / Storm-0940 password spray correlation rule. references: - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ author: AII-Detector — ThreadLinqs Intelligence date: 2026-11-04 tags: - attack.credential-access - attack.t1110.003 logsource: product: azure service: signinlogs detection: selection: ResultType: - 50126 - 50053 - 50034 condition: selection falsepositives: - Individual users mistyping passwords level: low --- title: Entra ID Password Spray - Many Distinct Accounts Failing From One Source (ARTEX Storm-0940) id: 9e2b7d44-1c63-4a8f-b5d0-6a3e8f12c7b9 status: experimental description: One source IP failing Entra ID authentication for 10 or more distinct accounts within one minute, matching the machine-speed ARTEX password spray attributed to Storm-0940. references: - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ - https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors author: AII-Detector — ThreadLinqs Intelligence date: 2026-11-04 tags: - attack.credential-access - attack.t1110.003 - attack.initial-access - attack.t1078.004 correlation: type: value_count rules: - artex_entra_failed_signin group-by: - IPAddress timespan: 1m condition: gte: 10 field: UserPrincipalName falsepositives: - Corporate NAT or proxy egress where many users share one IP after a password policy change - Vulnerability scanners or red-team password-audit exercises level: high ``` **Known false positives:** - Corporate NAT/proxy egress IP where many users fail sign-in simultaneously (e.g. after a password expiry wave or an SSO outage) - Authorized red-team or password-audit tooling run from a known IP **Tuning notes:** Exclude corporate egress and VPN IPs with a lookup. Lower the thresholds (distinct_users>=5, failures>=15) for low-volume tenants; raise them for large NAT'd sites. The IOC IP list is supplementary: ARTEX rotates IPs and user agents, so keep the volume/distinct-user logic as the primary trigger. Confirm the field names (properties.status.errorCode, properties.ipAddress) against your Splunk Add-on for Microsoft Cloud Services version. ### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds - Abused ConnectWise Cloud Backup / Cloud Management Application Identity Sign-ins (locked: unlock with TL Creds) - Bulk Azure Key Vault Secret Reads by Abused Application or Storm-0940 Source (locked: unlock with TL Creds) - Kerberoasting (RC4 TGS Bursts) and DCSync Replication Requests From Non-DC Accounts (locked: unlock with TL Creds) - Web Server Process Spawning Shell or Recon Utility (VAPOR PANDA JSP/PHP Web Shell) (locked: unlock with TL Creds) - BLOODALCHEMY DLL Side-Loading via Renamed GameHook svchost.exe (locked: unlock with TL Creds) - WinRM Remote Command Execution Chain via wsmprovhost.exe (ARTEX Lateral Movement) (locked: unlock with TL Creds) - ARTEX Cloud Privilege Escalation - Global Administrator Self-Assignment and Credential Addition to Service Principals (locked: unlock with TL Creds) - VAPOR PANDA C2 Infrastructure and Chisel / SoftEther Tunneling on Endpoints (locked: unlock with TL Creds) Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup ## Sample indicators (3 of 28) Defanged, TLP:CLEAR. - IP address: `144.172.64[.]128` - Domain: `nginxmysql[.]com` - File hash: `49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068` Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds ## Sources - [Hackers Use ARTEX AI to Automate Enterprise Attacks at Machine Speed - Insights for Defenders](https://cybersecuritynews.com/artex-ai-automate-enterprise-attacks/) - [Microsoft: Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) - [CrowdStrike: VAPOR PANDA uses ARTEX to scale global campaign](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/) - [Wiz: ARTEX in the wild - Storm-0940 expands targeting of IT and software vendors](https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors) - [Cloud Security Alliance: Multi-Agent Offensive Frameworks in the Wild - CyberStrikeAI and ARTEX](https://labs.cloudsecurityalliance.org/research/csa-research-note-cyberstrikeai-artex-multi-agent-offense-20/) - [The Hacker News: China-linked hackers use ARTEX AI](https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html) - [Cyber Security News: Hackers use ARTEX AI agents (Google Threat Intelligence Group / Mandiant coverage)](https://cybersecuritynews.com/hackers-use-artex-ai-agents/) - [ConnectWise Trust Advisories](https://www.connectwise.com/company/trust/advisories) - [Dark Reading: Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack](https://darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack) - [The Record: China cyber ConnectWise AI](https://therecord.media/china-cyber-connectwise-ai) ## Full data The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-5196