ARTEX open-source AI autonomous pentest framework abused by threat actors; 1,465 exposed consoles per Censys

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5865 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX Egress To LLM API Endpoints, xcai.pro Reseller and webhook.site

Detects endpoint DNS lookups for LLM API providers, the xcai.pro reseller used as the likely DeepSeek v4.1-flash backend in the CrowdStrike-reported South Korea campaign, and webhook.site, which GTIG observed ARTEX-driven activity using for C2 result posting (491 rotating URLs). Non-browser processes on servers resolving these names are strong indicators of an agentic offensive framework or a hijacked host (T1102, T1090, T1588.007).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1102, T1090, T1588.007
• Data sources: sysmon EventCode 22 (DNS query), microsoft_defender_for_endpoint DeviceNetworkEvents
• Severity: medium
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 earliest=-24h ```Sysmon DNS query: LLM APIs, xcai.pro reseller and webhook.site from non-browser processes```
| eval q=lower(QueryName)
| eval ioc_class=case(match(q,"(^|[.])(webhook[.]site|xcai[.]pro)$"),"oast_or_llm_reseller", match(q,"^(api[.]deepseek[.]com|api[.]x[.]ai|api[.]openai[.]com|api[.]anthropic[.]com|open[.]bigmodel[.]cn)$"),"llm_api")
| where isnotnull(ioc_class)
| where NOT match(lower(Image),"(chrome|msedge|firefox)[.]exe$")
| stats count AS queries dc(q) AS distinct_names values(q) AS names min(_time) AS first_seen max(_time) AS last_seen by host Image ioc_class

Microsoft KQL

let LlmAndOastDomains = dynamic(["webhook.site", "xcai.pro", "api.deepseek.com", "api.x.ai", "api.openai.com", "api.anthropic.com", "open.bigmodel.cn"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (LlmAndOastDomains)
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| extend IocClass = iff(RemoteUrl has_any ("webhook.site", "xcai.pro"), "oast_or_llm_reseller", "llm_api")
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), RemoteUrls = make_set(RemoteUrl, 10) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, IocClass
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, IocClass, Connections, RemoteUrls

Sigma

title: DNS Query To LLM API Provider Reseller Or webhook.site By Non-Browser Process
id: c81f4a96-3d27-4e5b-a0c8-7b19e5d2f634
status: experimental
description: Detects DNS lookups for LLM API endpoints, the xcai.pro LLM reseller reported by CrowdStrike and webhook.site, abused by ARTEX-driven activity for C2 result posting. Agentic offensive frameworks such as ARTEX require outbound access to an LLM backend.
references:
    - https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
    - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.command-and-control
    - attack.t1102
    - attack.t1090
    - attack.resource-development
    - attack.t1588.007
logsource:
    category: dns_query
    product: windows
detection:
    selection_exact:
        QueryName:
            - 'webhook.site'
            - 'xcai.pro'
            - 'api.deepseek.com'
            - 'api.x.ai'
            - 'api.openai.com'
            - 'api.anthropic.com'
            - 'open.bigmodel.cn'
    selection_subdomain:
        QueryName|endswith:
            - '.webhook.site'
            - '.xcai.pro'
    filter_main_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
    - Approved developer or data-science hosts that call LLM APIs
    - Webhook testing by developers
level: medium

Known false positives:

• Approved developer, data-science or AI-tooling hosts that legitimately call LLM APIs
• Developers testing webhooks with webhook.site

Tuning notes: Scope to servers and non-development endpoints, and allow-list approved AI-enabled hosts and service accounts. Add further LLM gateways and resellers observed in your egress logs; treat xcai.pro and webhook.site as high priority on server tiers. Correlate hits with a non-interactive parent process or scripting interpreter to raise confidence.

• 🔒 ARTEX Kudu SCM Command and VFS Write Abuse On Azure App Service · unlock with TL Creds
• 🔒 ARTEX DCSync Directory Replication By Non-Domain-Controller Account · unlock with TL Creds
• 🔒 Connections To ARTEX Reported, Community-Related and Co-Hosted C2 Infrastructure · unlock with TL Creds
• 🔒 ARTEX Database-Driven Webshell Write via MySQL general_log_file · unlock with TL Creds
• 🔒 ARTEX Kerberoasting Burst of RC4 Service Ticket Requests · unlock with TL Creds
• 🔒 ARTEX Lateral Movement via WinRM Host Process Spawning Shells and Discovery Tools · unlock with TL Creds
• 🔒 ARTEX / Storm-0940 Entra ID Machine-Speed Password Spray · unlock with TL Creds
• 🔒 ARTEX Post-Compromise OAuth Credential Addition and ArtexProbe Account Creation · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-5865.

Sample indicators (3 of 28)

• IP address: 38.244.50[.]120
• Domain: xcai[.]pro
• IP address: 101.53.80[.]20

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

Technical analysis

Censys counted 1,465 hosts exposing an ARTEX console, 155 of which also host other threat tooling such as Cobalt Strike, Vshell and Adaptix C2.

ARTEX was published on GitHub as Autumn-27/ARTEX on 2026-07-26 under AGPL-3.0. It is written in Go with an embedded Next.js web console and a PostgreSQL backend. Its Planner, Worker and event-driven agents (Google describes six specialized sub-agents) drive tools such as nmap and mitmproxy against an asset graph synced from ScopeSentry, and it connects to Anthropic, OpenAI or OpenAI-compatible LLM endpoints. The creator removed the original repository in October 2026 after widespread abuse and said it was intended only for authorized testing. Archived copies, translations and forks such as ScopeWeaver, and a commercial ARTEX PRO, continue to circulate. Check Point reports the developer made the project closed-source after the South Korea attacks.

CrowdStrike (2026-10-07) reported a campaign from late September to early October 2026 against South Korean financial organizations, including a loan-progress inquiry service used by brokers and an employee mobile work-support system. The unattributed actor, assessed with moderate confidence as a financially motivated Chinese speaker, ran an ARTEX instance at 38.244.50.120 with an open directory on port 18899 that exposed a Chinese-language Claude Code CLAUDE.md pentest prompt file. DeepSeek v4.1-flash was the primary ARTEX LLM backend, likely reached through the reseller xcai.pro, with GLM-5.3 and Grok 4.6 supplementing it, and traffic was routed through nine proxy IPs. The actor also used Claude Code to ask where Korean breach data is sold. Microsoft (2026-10-21) attributed a September-October 2026 campaign to Storm-0940 (also CovertNetwork-1658 / ORB07, China-aligned, active since 2021). Storm-0940 compromised ConnectWise application identities in its Cloud Backup (formerly SkyKick) environment, then attempted sign-ins to more than 2,250 customer tenants at about 2,900 attempts per minute, using password spraying, exploitation of internet-facing applications and the addition of credentials to existing OAuth applications. Google GTIG/Mandiant (2026-10-30) tracks overlapping activity as UNC7228 and documents noisy trial-and-error ARTEX behavior: Kudu/SCM abuse, Kerberoasting, DCSync, AD CS auditing, SQL general_log webshell writes, webhook.site C2 and ArtexProbe-named accounts.

Check Point Research (2026-11-05) identified 2,557 systems that hosted ARTEX panels, 1,608 of them live. Ten misconfigured instances exposed full databases showing autonomous agents at work: one crypto campaign ran 292 objectives and 400,791 agent messages with no further operator prompting and earned $0, and an Apple code-signing campaign obtained more than 300 certificates from 10 signing shops. CERT-In advisory CIAD-2026-0058 (2026-11-04) describes Crafty Falcon, which used ARTEX, CyberStrikeAI and Cairn against Indian NBFCs, fintechs, payment aggregators and crypto exchanges.

Censys (Silas Cutler, 2026-11-05) measured 1,465 exposed consoles as of 2026-11-03/04. About 650 sit in two identically configured hosting blocks, leaving about 815 distinct-looking deployments. 155 hosts (10.6%) co-host other threat artefacts, 70 share infrastructure with CyberStrikeAI, 32 have open directories of attack tooling, and 43 run LLM gateway or reseller software. Censys cautions that not every instance is malicious and that exposure alone does not prove malicious use. Defender priorities are fingerprinting and hunting for exposed consoles, egress monitoring for unfamiliar LLM proxies and resellers, hardening of control planes, identity and non-production environments, and behavioral detection of machine-speed, noisy multi-technique activity.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.006 OS Credential Dumping: DCSync; T1110.003 Brute Force: Password Spraying; T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Lateral Movement

T1021.006 Remote Services: Windows Remote Management; T1550.002 Use Alternate Authentication Material: Pass the Hash

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1648 Serverless Execution

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1087.002 Account Discovery: Domain Account

Command and Control

T1090 Proxy

Persistence

T1098.001 Account Manipulation: Additional Cloud Credentials; T1136.003 Create Account: Cloud Account; T1505.003 Server Software Component: Web Shell

Collection

T1530 Data from Cloud Storage

Resource Development

T1583.003 Acquire Infrastructure: Virtual Private Server; T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation

Patches

• No CVE is tied to ARTEX itself; patch internet-facing applications quickly, prioritizing PHP and Node.js file-upload and deserialization flaws, with WAF virtual patching as an interim step

Immediate actions

• Hunt for ARTEX consoles on your own and third-party-facing ranges: page title beginning with 'ARTEX' plus Next.js _next/static assets, typically on 8787/tcp (also 8790, 443, 80)
• Block and hunt for the CrowdStrike-reported IPs 38.244.50.120 and the proxy list, the Microsoft-reported 144.172.64.60/.99/.128, and the domain xcai.pro
• Review Microsoft 365 tenants connected to ConnectWise for unauthorized changes, new OAuth application credentials and privileged role changes; keep affected connections disabled until ConnectWise issues reconnection instructions
• Alert on server or non-development hosts calling LLM APIs, LLM proxies/resellers, webhook.site and other OAST/tunneling services
• Flag small test transfers to new payees followed by large transfers (CERT-In)

Workarounds

• Do not expose ARTEX or similar agentic pentest consoles to the internet; the control panel does not need public access
• Ban unauthorized public AI-driven offensive frameworks from corporate infrastructure
• Store crypto wallet keys in HSMs or cold custody

Longer-term hardening

• Restrict admin APIs, consoles, Kudu/SCM and CI/CD to trusted networks; replace static keys with short-lived credentials
• Fully separate non-production (UAT/staging) from production: no shared credentials, tokens, databases or network paths
• Limit database runtime privileges (no OS command execution, file writes or SET GLOBAL); make web deployment directories read-only with file-integrity monitoring for web shells
• Harden Active Directory and AD CS (remove ENROLLEE_SUPPLIES_SUBJECT templates, enable Credential Guard, SMB/LDAP signing, channel binding); reduce NTLM
• Apply rate and recipient limits to high-impact APIs and treat client apps as untrusted (signed requests, nonces, app attestation, certificate pinning)
• Tune SIEM and SOAR for machine-speed, parallel, off-hours multi-technique activity; keep identity, cloud, network, DNS and endpoint logs

Affected and fixed versions

• ConnectWise — Cloud Backup (formerly SkyKick), SaaS Security, Cloud Management
  Vulnerable versions: Cloud services taken offline after application identity compromise, Oct 2026
  Fixed in: Phased restoration of Cloud Backup announced 2026-10-22
• Microsoft — Microsoft 365 customer tenants connected to ConnectWise applications
  Vulnerable versions: Tenants with ConnectWise-linked application identities
• South Korean financial institutions — Loan progress inquiry service for brokers; employee mobile work-support system
  Vulnerable versions: Systems breached Sept-Oct 2026 (initial access vector not disclosed)

Timeline

• 2026-07-26 ARTEX published on GitHub as Autumn-27/ARTEX under AGPL-3.0 (Go, Next.js console, PostgreSQL backend).
• 2026-09-15 Late-September activity: the Chinese-speaking actor's ARTEX campaign against South Korean financial organizations begins (CrowdStrike: late September to early October); Microsoft dates the Storm-0940 campaign against hundreds of organizations to September 2026. Date is approximate (month-level in sources).
• 2026-10-07 CrowdStrike publishes its analysis of the ARTEX-driven South Korean finance campaign, with moderate-confidence attribution to a financially motivated Chinese speaker.
• 2026-10-15 ConnectWise identifies suspicious activity in its network.
• 2026-10-17 ConnectWise discovers unauthorized access to application identities in its Cloud Backup environment.
• 2026-10-21 Microsoft publishes its blog attributing the ARTEX-enabled ConnectWise tenant campaign to Storm-0940; ConnectWise posts an update.
• 2026-10-22 ConnectWise announces a phased restoration of Cloud Backup after taking several cloud services offline.
• 2026-10-30 Google GTIG/Mandiant publishes its analysis of ARTEX and other agentic offensive frameworks, linking activity to UNC7228 / Storm-0940. The original ARTEX repository had been taken down by its creator in October 2026.
• 2026-11-04 CERT-In publishes advisory CIAD-2026-0058 on Crafty Falcon using ARTEX, CyberStrikeAI and Cairn against financial and crypto organizations.
• 2026-11-05 Censys reports 1,465 exposed ARTEX consoles (about 815 distinct); Check Point Research publishes findings on 2,557 ARTEX-hosting systems and autonomous agent behavior.

Sources cited

• Censys: ARTEX Agentic Asbestos censys.com · Research · 2026-11-05
• CrowdStrike: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance CrowdStrike · Vendor report · 2026-10-07
• Check Point Research: Inside ARTEX - How Autonomous AI Agents Are Being Used in Real-World Cyberattacks Check Point · Research · 2026-11-05
• Google Cloud Threat Intelligence: ARTEX and Friends Enter Agentic Offensive Frameworks Google Cloud · Vendor report · 2026-10-30
• ARTEX Offensive AI Tool Activity Far Exceeds Reported Campaigns, Censys Finds infosecurity-magazine.com · News · 2026-11-06
• Microsoft Says Chinese Hackers Used AI Tool in ConnectWise Compromise (Infosecurity Magazine) infosecurity-magazine.com · News · 2026-10-21
• India Warns of AI-Driven Cyberattacks on Financial Sector; CERT-In CIAD-2026-0058 (Infosecurity Magazine) infosecurity-magazine.com · News · 2026-11-04
• Chinese Hacker Deployed AI in Campaign Against South Korean Banks (Infosecurity Magazine) infosecurity-magazine.com · News · 2026-10-08
• Hacker used ARTEX AI and Claude agents to target South Korean banks (BleepingComputer) BleepingComputer · News · 2026-10-08
• Chinese-speaking hacker possibly linked to AI-driven attacks on S. Korean banks (Korea Times) koreatimes.co.kr · News · 2026-10-08

More in threat intel

• ARTEX open-source AI pentesting framework weaponized by China-aligned and criminal actors (Storm-0940, VAPOR PANDA, Storm-3358, Crafty Falcon); leaked secrets are the primary entry vector; backdoored Docker images
• Ransomware without data theft may trigger mandatory breach reporting under India's DPDP framework (K7 CyberSecurity)
• AI-Accelerated Exploitation and Agentic Post-Compromise Activity (PHP2Shell CVE-2026-109618/109619, DIVD Zammad Breach CVE-2026-102489/102490) — Shift from Patching to Mitigation
• AI-Agent-Driven Intrusion Campaign Against Asian Government Systems (reported as Taiwan-targeted): Multi-Agent Password Spraying, SSO Pivoting and JWT 'none' Forgery
• School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)

More from Storm-0940

• ~45 Open-Source AI Hacking Frameworks Mapped; Hundreds of Agent Attack Consoles Exposed Online (ARTEX Family)
• ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions
• ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data Theft
• Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise/SkyKick OAuth Supply-Chain Compromise of Microsoft 365 Tenants