ARTEX open-source AI pentesting framework weaponized by China-aligned and criminal actors (Storm-0940, VAPOR PANDA, Storm-3358, Crafty Falcon); leaked secrets are the primary entry vector; backdoored Docker images

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5980 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX Backdoored Binary Spawns Root Shell (verifyCaptcha RCE) — Exploitation

Detects the /app/artex binary from the backdoored tomicdd/artex and congdonglinux/artex Docker images spawning a root shell with sh -c. The server.verifyCaptcha backdoor runs the 'captcha' JSON field of an unauthenticated POST /api/auth/login via sh -c as root before credential checks, with no C2 callback, so process lineage on the Linux host or container is the most reliable signal. Any hit means the host should be rebuilt and every stored key plus /app/jwt.key rotated.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1195.002, T1190
• Data sources: sysmon_for_linux, linux_process_creation, defender_for_endpoint_linux
• Severity: critical
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 (ParentImage="/app/artex" OR ParentImage="*/artex") (Image="*/sh" OR Image="*/bash" OR Image="*/dash") CommandLine="*-c *" User="root"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentCommandLine) as parent_cmd by host User ParentImage Image
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen host User ParentImage Image count commands parent_cmd

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "artex" or InitiatingProcessFolderPath endswith "/app/artex"
| where FileName in~ ("sh", "bash", "dash")
| where ProcessCommandLine has " -c"
| where AccountName =~ "root"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: ARTEX Backdoored Binary Spawns Root Shell via verifyCaptcha
id: 3b8f2c14-6a9d-4e71-b5c3-0d7e91a4f201
status: experimental
description: Detects the /app/artex binary from the backdoored tomicdd/artex and congdonglinux/artex Docker images spawning a root shell with sh -c, the behaviour of the server.verifyCaptcha backdoor triggered by an unauthenticated POST to /api/auth/login.
references:
  - https://badbyte.io/artex-backdoor-docker-image/
  - https://www.stepsecurity.io/blog/artex-ai-pentesting-tool-attackers-leaked-secrets
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial-access
  - attack.t1195.002
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/artex'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
    CommandLine|contains: ' -c '
    User: 'root'
  condition: selection_parent and selection_child
falsepositives:
  - Authorised red-team use of an unmodified ARTEX whose shell tool legitimately launches sh -c
  - Container health checks that run through the ARTEX entrypoint
level: high

Known false positives:

• Authorised red-team engagements running ARTEX whose agent shell tool legitimately spawns sh -c
• Container entrypoint or health-check scripts launched by an unmodified ARTEX build

Tuning notes: Allow-list known authorised ARTEX hosts by host name. For fidelity, pair with Docker image inventory alerts for tomicdd/artex, congdonglinux/artex and the sha256 d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573. If your Linux telemetry is auditd rather than Sysmon for Linux, map exe=/app/artex and the execve of sh -c to the same fields.

• 🔒 Entra ID Service Principal Wrong or Expired Secret Followed by Success (Leaked Secret Validation) · unlock with TL Creds
• 🔒 Azure Key Vault Bulk Secret Reads After Credential Compromise (ARTEX) · unlock with TL Creds
• 🔒 Chisel and SoftEther Tunnel Tooling Execution (VAPOR PANDA Post-Exploitation) · unlock with TL Creds
• 🔒 ARTEX Operator HTTP User Agents and Known Operator IPs in Web Logs · unlock with TL Creds
• 🔒 BLOODALCHEMY DLL Sideloading via Renamed GameHook svchost.exe (VAPOR PANDA) · unlock with TL Creds
• 🔒 Server Contacting AI Model APIs Without Business Justification (ARTEX Operator Host) · unlock with TL Creds
• 🔒 ARTEX Entra ID Privilege Escalation Chain — App Credential Added Then Admin Role Assigned · unlock with TL Creds
• 🔒 ARTEX Operator, BLOODALCHEMY C2 and Storm-0940 Infrastructure Network Contact · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-5980.

Sample indicators (3 of 27)

• IP address: 91.92.240[.]238
• Domain: nginxmysql[.]com
• File hash: d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Community OSINT corroboration

4 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Backdoored Docker images (tomicdd/artex, congdonglinux/artex) were distributed to ARTEX operators until Docker removed them on 2026-11-05.

ARTEX is a multi-agent AI penetration-testing framework (Go server, Next.js console, PostgreSQL, typically deployed with Docker Compose; v0.3.15 analyzed). The console and API listen on port 8787 and the supplied Compose file exposes it on all interfaces. A planner agent coordinates worker agents (three per task by default) that drive tools such as nmap, a shell and an HTTP client, plus chat and retest agents. The operator supplies the LLM; attackers mostly used DeepSeek models through resellers. Scope controls (.gov/.edu blocked, approval for risky actions) are soft; CERT-EU found no hard technical enforcement. The developer took the project closed-source and removed the repository on 2026-10-08 after more than 12,000 forks existed; forks and copies persist.

The tool was adopted by multiple unrelated actors. Microsoft attributes Storm-0940 (China state-aligned, active since 2021) ARTEX operations from early September 2026, including a cross-tenant password spray (2026-10-10 to 10-14, 151,000+ failed sign-ins against 327 accounts in eight organizations, from 144.172.64.99) and the ConnectWise Cloud Backup supply-chain compromise, after which stolen multi-tenant application credentials were used for sign-ins against 2,250+ tenants, with privileged cloud access in under three hours in some cases (Graph reconnaissance, app credential additions, self-assigned Global Administrator, bulk Key Vault secret reads). Wiz observed related behavior against IT and software vendors: source map and OpenAPI harvesting, fabricated OAuth callbacks, unsigned alg:none JWT tests against 60+ SSO routes, password spraying of Entra ID and Okta, and AWS Cognito abuse. CrowdStrike tracks VAPOR PANDA (China-linked) running an 11-day campaign from 2026-10-17 against 200+ organizations in 14 countries (post-exploitation confirmed at nine), mostly government, defense, telecom and pharma, using exposed SAML and XXE flaws, stolen VPN configurations, web shells, Chisel/SoftEther tunnels and the BLOODALCHEMY backdoor; operators tasked agents to find Windows hosts without the CrowdStrike Falcon sensor, and one intrusion consumed about 1.4 billion input tokens. Storm-3358 (Cambodia-based, criminal) targets Southeast Asian financial firms; Crafty Falcon (CERT-In CIAD-2026-0058) targets Indian lenders, fintechs and exchanges via internet-facing test/staging systems and shared credentials; a Korean ring (7 suspects, 90+ organizations, 8.2 million records, 38 ransom demands) was arrested by Seoul police on 2026-10-15. Google Threat Intelligence lists PentAGI, HexStrike and Cairn as similar frameworks.

Leaked secrets are the fastest route: agents search public GitHub for target names plus terms like 'secret', find Entra ID application client secrets, then reach storage keys, connection strings, Kubernetes credentials and Key Vault contents (one case went from GitHub search to Key Vault theft in five minutes; 200+ client secrets were validated in about three minutes). Weak development credentials on internet-facing staging/internal tools are the second route (WorkOS incident, where a researcher's agent escaped its test scope). Separately, BadByte documented a backdoored build: a GitHub fork (commit a4f4d38) changed the Compose image to tomicdd/artex, whose /app/artex binary adds server.verifyCaptcha, executing a 'captcha' JSON field via sh -c as root on unauthenticated POST /api/auth/login before credential checks. It has no C2 callback; any host that ran it should be rebuilt and all stored keys and the JWT signing key rotated.

Detection relies on behavior rather than static indicators: request bursts of 1-14 requests about one second apart followed by 25-31 second pauses, Entra ID errors AADSTS7000215 (wrong client secret) and AADSTS7000222 (expired client secret) followed by a success, one IP signing in as many applications, canary inputs (evil.com, test@example.com), write-then-delete storage tests, exposed port 8787 consoles titled ARTEX, and servers calling AI model APIs without business reason. No CVEs are associated with this activity; the source reports no software-vulnerability exploitation in several cases.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1651 Cloud Administration Command

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1199 Trusted Relationship

Discovery

T1087.004 Account Discovery: Cloud Account; T1518.001 Software Discovery: Security Software Discovery

Command and Control

T1090.003 Proxy: Multi-hop Proxy

Persistence

T1098.001 Account Manipulation: Additional Cloud Credentials; T1098.003 Account Manipulation: Additional Cloud Roles; T1505.003 Server Software Component: Web Shell

Credential Access

T1110.003 Brute Force: Password Spraying; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1555.006 Credentials from Password Stores: Cloud Secrets Management Stores; T1606.002 Forge Web Credentials: SAML Tokens

Defense Evasion

T1574.001 Hijack Execution Flow: DLL

Resource Development

T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1593.003 Search Open Websites/Domains: Code Repositories

Remediation

Patches

• No CVE or vendor patch applies; review ConnectWise advisory for Cloud Backup credential rotation guidance

Immediate actions

• Scan repositories, forks and full git history for secrets; enable GitHub secret scanning and push protection
• Rotate every secret ever committed or printed to a log; deleting the commit is not sufficient
• Hunt web, proxy and API gateway logs for the listed user agents, IPs, JA4 fingerprints and the burst/pause request rhythm
• Review Entra ID service principal sign-ins for AADSTS7000215 and AADSTS7000222; treat a failure followed by a success as urgent
• If ARTEX was installed from tomicdd/artex or congdonglinux/artex, rebuild the host and rotate AI provider keys, database password, webhook/SMTP/proxy credentials and /app/jwt.key

Workarounds

• Bind ARTEX console port 8787 to localhost and use VPN or SSH tunnel; complete admin setup before accepting outside connections
• Enforce engagement scope with network controls rather than the tool's soft scope settings

Longer-term hardening

• Replace stored CI cloud keys with OIDC short-lived tokens; set PAT expiry and prefer fine-grained tokens
• Move Entra ID applications from client secrets to managed identities or certificates
• Audit internet-facing internal, test and staging systems; never accept default, development or shared credentials, and do not share credentials between test and production
• Remove OpenAPI specs, source maps and config files with tokens from internet-facing apps; rate-limit and bot-protect registration, password reset and verification endpoints
• Alert on servers calling AI model APIs without business justification and on first use of a cloud key from a new IP

Affected and fixed versions

• Microsoft — Entra ID applications / Azure Key Vault / Microsoft 365 tenants
  Vulnerable versions: Applications using long-lived client secrets or exposed credentials
• ConnectWise — ConnectWise Cloud Backup and related ConnectWise apps
  Vulnerable versions: Multi-tenant app credentials compromised (see ConnectWise advisory)
• Autumn-27 — ARTEX (Docker images tomicdd/artex, congdonglinux/artex)
  Vulnerable versions: Backdoored /app/artex build v0.3.16-0.20261008134550-5c0dbd4bec94+dirty
  Fixed in: Images removed from Docker Hub 2026-11-05; rebuild from known-good source

Timeline

• 2026-07-26 ARTEX (Autumn-27/ARTEX, AGPL-3.0) first appears on GitHub.
• 2026-09-01 Early September: Storm-0940 begins ARTEX-driven operations per Microsoft; a South Korean criminal ring and Google-observed activity began in August.
• 2026-10-07 CrowdStrike links ARTEX to attacks on South Korean financial institutions.
• 2026-10-08 Developer announces ARTEX is closed-source and removes the repository after 12,000+ forks exist; a backdoored copy appears that evening (Docker Hub account tomicdd created 18:50 UTC).
• 2026-10-10 Storm-0940 cross-tenant password spray from locked-ioc-15 begins (through 2026-10-14): 151,000+ failed sign-ins against 327 accounts in eight organizations.
• 2026-10-15 Seoul police arrest the leader of a Korean ARTEX-using ring (7 suspects, 90+ organizations, 8.2 million records, 38 ransom demands); ConnectWise compromise reports surface.
• 2026-10-17 VAPOR PANDA begins an 11-day ARTEX campaign against 200+ organizations in 14 countries; post-exploitation confirmed at nine.
• 2026-10-21 Microsoft attributes the ConnectWise Cloud Backup supply-chain compromise to Storm-0940 using ARTEX; sign-ins attempted against 2,250+ tenants.
• 2026-11-02 Backdoored ARTEX image deployed on 15 hosts in locked-ioc-9 (09:25-09:38 UTC).
• 2026-11-04 BadByte details the backdoored Docker image; CERT-In warns about Crafty Falcon; Censys counts 1,465 exposed consoles.
• 2026-11-05 Docker removes tomicdd/artex and congdonglinux/artex; Microsoft reports AI agents hunting GitHub for exposed secrets.
• 2026-11-06 Microsoft reports Cambodia-based Storm-3358 using ARTEX against Southeast Asian financial firms; WorkOS names the researcher in its October 30 incident.
• 2026-11-12 StepSecurity publishes its analysis of ARTEX adoption and leaked-secret exploitation.

Sources cited

• CERT-EU: From penetration testing to cyber threat, beware of ARTEX CERT-EU · Advisory
• Microsoft: Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise Microsoft · Vendor report · 2026-10-21
• Microsoft: Threat actors use agentic AI tooling to find and abuse exposed secrets Microsoft · Vendor report · 2026-11-05
• Microsoft: ARTEX abuse expands as cybercriminals target financial sector Microsoft · Vendor report · 2026-11-06
• Wiz: ARTEX in the wild: Storm-0940 expands targeting of IT and software vendors Wiz · Research · 2026-10-22
• CrowdStrike: VAPOR PANDA uses ARTEX to scale global campaign CrowdStrike · Vendor report · 2026-10-29
• CrowdStrike: Unknown threat actor uses ARTEX to target South Korean finance CrowdStrike · Vendor report · 2026-10-07
• BadByte: ARTEX backdoor Docker image badbyte.io · Research · 2026-11-04
• Unit 42: ARTEX and AI-powered red teaming tools Unit 42 · Research
• Censys: ARTEX agentic asbestos censys.com · Research · 2026-11-04
• Google Threat Intelligence: ARTEX and friends enter agentic offensive frameworks Google Cloud · Research
• WorkOS: Update for October 30th 2026 data security incident workos.com · Vendor report · 2026-11-06
• StepSecurity: ARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In. stepsecurity.io · Blog · 2026-11-12
• GitGuardian: AI pentesting tools beyond ARTEX blog.gitguardian.com · Blog
• BleepingComputer: Former pentester used ARTEX AI to steal 8.2 million data records BleepingComputer · News

More in threat intel

• Ransomware without data theft may trigger mandatory breach reporting under India's DPDP framework (K7 CyberSecurity)
• ARTEX open-source AI autonomous pentest framework abused by threat actors; 1,465 exposed consoles per Censys
• AI-Accelerated Exploitation and Agentic Post-Compromise Activity (PHP2Shell CVE-2026-109618/109619, DIVD Zammad Breach CVE-2026-102489/102490) — Shift from Patching to Mitigation
• AI-Agent-Driven Intrusion Campaign Against Asian Government Systems (reported as Taiwan-targeted): Multi-Agent Password Spraying, SSO Pivoting and JWT 'none' Forgery
• School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)

More from Storm-0940

• ~45 Open-Source AI Hacking Frameworks Mapped; Hundreds of Agent Attack Consoles Exposed Online (ARTEX Family)
• ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions
• ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data Theft
• Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise/SkyKick OAuth Supply-Chain Compromise of Microsoft 365 Tenants