# ARTEX open-source AI pentesting framework weaponized by China-aligned and criminal actors (Storm-0940, VAPOR PANDA, Storm-3358, Crafty Falcon); leaked secrets are the primary entry vector; backdoored Docker images

> ARTEX (GitHub Autumn-27/ARTEX, AGPL-3.0, first seen 2026-07-26) is an open-source multi-agent LLM pentesting framework that state-aligned groups (Storm-0940, VAPOR PANDA) and criminal crews (Storm-3358, Crafty Falcon, a Korean ring) used against hundreds of organizations, with leaked secrets and weak or development credentials as the fastest way in. Backdoored Docker images (tomicdd/artex, congdonglinux/artex) were distributed to ARTEX operators until Docker removed them on 2026-11-05.

- **Published:** 2026-11-13T16:53:41Z
- **Last reviewed:** 2026-11-13T16:53:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5980
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5980.png
- **ID:** TL-2026-5980
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Storm-0940 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)

## Description

ARTEX is a multi-agent AI penetration-testing framework (Go server, Next.js console, PostgreSQL, typically deployed with Docker Compose; v0.3.15 analyzed). The console and API listen on port 8787 and the supplied Compose file exposes it on all interfaces. A planner agent coordinates worker agents (three per task by default) that drive tools such as nmap, a shell and an HTTP client, plus chat and retest agents. The operator supplies the LLM; attackers mostly used DeepSeek models through resellers. Scope controls (.gov/.edu blocked, approval for risky actions) are soft; CERT-EU found no hard technical enforcement. The developer took the project closed-source and removed the repository on 2026-10-08 after more than 12,000 forks existed; forks and copies persist.

The tool was adopted by multiple unrelated actors. Microsoft attributes Storm-0940 (China state-aligned, active since 2021) ARTEX operations from early September 2026, including a cross-tenant password spray (2026-10-10 to 10-14, 151,000+ failed sign-ins against 327 accounts in eight organizations, from 144.172.64.99) and the ConnectWise Cloud Backup supply-chain compromise, after which stolen multi-tenant application credentials were used for sign-ins against 2,250+ tenants, with privileged cloud access in under three hours in some cases (Graph reconnaissance, app credential additions, self-assigned Global Administrator, bulk Key Vault secret reads). Wiz observed related behavior against IT and software vendors: source map and OpenAPI harvesting, fabricated OAuth callbacks, unsigned alg:none JWT tests against 60+ SSO routes, password spraying of Entra ID and Okta, and AWS Cognito abuse. CrowdStrike tracks VAPOR PANDA (China-linked) running an 11-day campaign from 2026-10-17 against 200+ organizations in 14 countries (post-exploitation confirmed at nine), mostly government, defense, telecom and pharma, using exposed SAML and XXE flaws, stolen VPN configurations, web shells, Chisel/SoftEther tunnels and the BLOODALCHEMY backdoor; operators tasked agents to find Windows hosts without the CrowdStrike Falcon sensor, and one intrusion consumed about 1.4 billion input tokens. Storm-3358 (Cambodia-based, criminal) targets Southeast Asian financial firms; Crafty Falcon (CERT-In CIAD-2026-0058) targets Indian lenders, fintechs and exchanges via internet-facing test/staging systems and shared credentials; a Korean ring (7 suspects, 90+ organizations, 8.2 million records, 38 ransom demands) was arrested by Seoul police on 2026-10-15. Google Threat Intelligence lists PentAGI, HexStrike and Cairn as similar frameworks.

Leaked secrets are the fastest route: agents search public GitHub for target names plus terms like 'secret', find Entra ID application client secrets, then reach storage keys, connection strings, Kubernetes credentials and Key Vault contents (one case went from GitHub search to Key Vault theft in five minutes; 200+ client secrets were validated in about three minutes). Weak development credentials on internet-facing staging/internal tools are the second route (WorkOS incident, where a researcher's agent escaped its test scope). Separately, BadByte documented a backdoored build: a GitHub fork (commit a4f4d38) changed the Compose image to tomicdd/artex, whose /app/artex binary adds server.verifyCaptcha, executing a 'captcha' JSON field via sh -c as root on unauthenticated POST /api/auth/login before credential checks. It has no C2 callback; any host that ran it should be rebuilt and all stored keys and the JWT signing key rotated.

Detection relies on behavior rather than static indicators: request bursts of 1-14 requests about one second apart followed by 25-31 second pauses, Entra ID errors AADSTS7000215 (wrong client secret) and AADSTS7000222 (expired client secret) followed by a success, one IP signing in as many applications, canary inputs (evil.com, test@example.com), write-then-delete storage tests, exposed port 8787 consoles titled ARTEX, and servers calling AI model APIs without business reason. No CVEs are associated with this activity; the source reports no software-vulnerability exploitation in several cases.

## MITRE ATT&CK

- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1593.003 Search Open Websites/Domains: Code Repositories
- T1552.001 Unsecured Credentials: Credentials In Files
- T1078.004 Valid Accounts: Cloud Accounts
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1110.003 Brute Force: Password Spraying
- T1528 Steal Application Access Token
- T1555.006 Credentials from Password Stores: Cloud Secrets Management Stores
- T1606.002 Forge Web Credentials: SAML Tokens
- T1098.001 Account Manipulation: Additional Cloud Credentials
- T1098.003 Account Manipulation: Additional Cloud Roles
- T1505.003 Server Software Component: Web Shell
- T1651 Cloud Administration Command
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1574.001 Hijack Execution Flow: DLL
- T1518.001 Software Discovery: Security Software Discovery
- T1087.004 Account Discovery: Cloud Account
- T1090.003 Proxy: Multi-hop Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ARTEX Backdoored Binary Spawns Root Shell (verifyCaptcha RCE) — Exploitation** (`TL-2026-5980-SPL-001`)

Detects the /app/artex binary from the backdoored tomicdd/artex and congdonglinux/artex Docker images spawning a root shell with sh -c. The server.verifyCaptcha backdoor runs the 'captcha' JSON field of an unauthenticated POST /api/auth/login via sh -c as root before credential checks, with no C2 callback, so process lineage on the Linux host or container is the most reliable signal. Any hit means the host should be rebuilt and every stored key plus /app/jwt.key rotated.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1195.002, T1190
- **Data sources:** sysmon_for_linux, linux_process_creation, defender_for_endpoint_linux
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 (ParentImage="/app/artex" OR ParentImage="*/artex") (Image="*/sh" OR Image="*/bash" OR Image="*/dash") CommandLine="*-c *" User="root"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentCommandLine) as parent_cmd by host User ParentImage Image
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen host User ParentImage Image count commands parent_cmd
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "artex" or InitiatingProcessFolderPath endswith "/app/artex"
| where FileName in~ ("sh", "bash", "dash")
| where ProcessCommandLine has " -c"
| where AccountName =~ "root"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: ARTEX Backdoored Binary Spawns Root Shell via verifyCaptcha
id: 3b8f2c14-6a9d-4e71-b5c3-0d7e91a4f201
status: experimental
description: Detects the /app/artex binary from the backdoored tomicdd/artex and congdonglinux/artex Docker images spawning a root shell with sh -c, the behaviour of the server.verifyCaptcha backdoor triggered by an unauthenticated POST to /api/auth/login.
references:
  - https://badbyte.io/artex-backdoor-docker-image/
  - https://www.stepsecurity.io/blog/artex-ai-pentesting-tool-attackers-leaked-secrets
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial-access
  - attack.t1195.002
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/artex'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
    CommandLine|contains: ' -c '
    User: 'root'
  condition: selection_parent and selection_child
falsepositives:
  - Authorised red-team use of an unmodified ARTEX whose shell tool legitimately launches sh -c
  - Container health checks that run through the ARTEX entrypoint
level: high
```

**Known false positives:**

- Authorised red-team engagements running ARTEX whose agent shell tool legitimately spawns sh -c
- Container entrypoint or health-check scripts launched by an unmodified ARTEX build

**Tuning notes:** Allow-list known authorised ARTEX hosts by host name. For fidelity, pair with Docker image inventory alerts for tomicdd/artex, congdonglinux/artex and the sha256 d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573. If your Linux telemetry is auditd rather than Sysmon for Linux, map exe=/app/artex and the execve of sh -c to the same fields.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Entra ID Service Principal Wrong or Expired Secret Followed by Success (Leaked Secret Validation) (locked: unlock with TL Creds)
- Azure Key Vault Bulk Secret Reads After Credential Compromise (ARTEX) (locked: unlock with TL Creds)
- Chisel and SoftEther Tunnel Tooling Execution (VAPOR PANDA Post-Exploitation) (locked: unlock with TL Creds)
- ARTEX Operator HTTP User Agents and Known Operator IPs in Web Logs (locked: unlock with TL Creds)
- BLOODALCHEMY DLL Sideloading via Renamed GameHook svchost.exe (VAPOR PANDA) (locked: unlock with TL Creds)
- Server Contacting AI Model APIs Without Business Justification (ARTEX Operator Host) (locked: unlock with TL Creds)
- ARTEX Entra ID Privilege Escalation Chain — App Credential Added Then Admin Role Assigned (locked: unlock with TL Creds)
- ARTEX Operator, BLOODALCHEMY C2 and Storm-0940 Infrastructure Network Contact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `91.92.240[.]238`
- Domain: `nginxmysql[.]com`
- File hash: `d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [StepSecurity: ARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.](https://www.stepsecurity.io/blog/artex-ai-pentesting-tool-attackers-leaked-secrets)
- [Microsoft: Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)
- [Microsoft: Threat actors use agentic AI tooling to find and abuse exposed secrets](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/)
- [Microsoft: ARTEX abuse expands as cybercriminals target financial sector](https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/)
- [Wiz: ARTEX in the wild: Storm-0940 expands targeting of IT and software vendors](https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors)
- [CrowdStrike: VAPOR PANDA uses ARTEX to scale global campaign](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/)
- [CrowdStrike: Unknown threat actor uses ARTEX to target South Korean finance](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/)
- [BadByte: ARTEX backdoor Docker image](https://badbyte.io/artex-backdoor-docker-image/)
- [Unit 42: ARTEX and AI-powered red teaming tools](https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/)
- [Censys: ARTEX agentic asbestos](https://censys.com/blog/artex-agentic-asbestos/)
- [Google Threat Intelligence: ARTEX and friends enter agentic offensive frameworks](https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks)
- [GitGuardian: AI pentesting tools beyond ARTEX](https://blog.gitguardian.com/ai-pentesting-tools-beyond-artex/)
- [CERT-EU: From penetration testing to cyber threat, beware of ARTEX](https://cert.europa.eu/blog/from-penetration-testing-to-cyber-threat-beware-of-artex)
- [WorkOS: Update for October 30th 2026 data security incident](https://workos.com/security/bulletins/update-for-october-30th-2026-data-security-incident)
- [BleepingComputer: Former pentester used ARTEX AI to steal 8.2 million data records](https://www.bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5980