ARTEX is an open-source AI pentesting framework that attackers turned into a weapon in 2026. To defend against it, patch internet-facing apps and lock down identity and keys. Watch for its noisy footprint too. Then pentest your own attack surface continuously. You want to find the exposures its agents exploit before they do.
ARTEX started as an open-source AI pentesting tool. Since August 2026 it has shown up in attacks on banks, a security nonprofit, and an IT vendor's customers. This post covers what ARTEX is and who it hit. Then it walks through how attackers use it and what you can do today.
What is ARTEX?
ARTEX is a multi-agent AI platform for pentesting and command-and-control (C2). Google's Threat Intelligence Group says it is written in Go with a Next.js web console. It splits an attack across six specialized sub-agents. A GitHub user called Autumn-27 released it as open source.
On October 8, 2026, the developer posted a statement that ARTEX was being misused. It said ARTEX would get no more updates and would become closed source. Google says forks still spread, including ScopeWeaver and a paid "ARTEX PRO." CrowdStrike found one attacker running it on DeepSeek V4.1 Flash, GLM-5.3, and Grok 4.6.
Which companies have been attacked with ARTEX?
Most ARTEX victims have not been named. The table below names an organization only where public reporting does.
| Victim | What happened | Source |
|---|---|---|
| Shinhan Bank, KB Kookmin Bank, and Hana Bank (South Korea) | Customer data was stolen in late September and early October 2026. Zscaler counts personal data for about 67,000 people across Korean financial firms. | The Record , Zscaler |
| DIVD (Netherlands) | An agent chained two zero-days in the Zammad help desk to reach root. DIVD's logs show over 450,000 requests and 2,500 scripts. | DIVD |
| ConnectWise | Credentials for its Cloud Backup app were stolen. Microsoft ties the theft to Storm-0940, a China-aligned group it says uses ARTEX. | Microsoft , ConnectWise |
| WorkOS | An attacker reached an internal sales app on October 30. CRM contacts and summaries of customer calls were exposed. Its founder said the attacker used ARTEX. | BleepingComputer |
| About 20 Japanese companies (unnamed) | GMO Cybersecurity by Ierae found ARTEX on an attack server aimed at them. Eight of them disclosed breaches in September and October. | GMO Ierae |
| 200+ organizations in at least 14 countries (unnamed) | Vapor Panda targeted foreign ministries, telecoms, and US pharma and defense firms. CrowdStrike confirmed post-exploitation at nine of them. | CrowdStrike |
| 90+ Korean organizations (unnamed) | Police say a seven-person gang used ARTEX to steal 8.2 million records. Victims include schools, hospitals, and large companies. | BleepingComputer |
Attribution is messy. CrowdStrike has moderate confidence that the Korean bank attacker is a financially motivated Chinese speaker. It has not named the group. Vapor Panda is a separate espionage group, so one tool does not mean one actor.
How are attackers using ARTEX?
Attackers point ARTEX at a target and let its agents do the work. A human still steers at key moments. CrowdStrike saw Vapor Panda operators give orders in Chinese, such as finding Windows machines without Falcon installed.
- Breaking into internet-facing apps. Agents ran recon, SQL injection, and auth bypass against Korean financial firms (Zscaler ). At DIVD, the agent chained CVE-2026-102489 and CVE-2026-102490 into root (DIVD ).
- Spraying passwords. Storm-0940 hit 327 accounts at eight organizations with over 151,000 failed logins in five days (Microsoft ). It also abused OAuth app credentials and gave itself Global Admin.
- Taking over Active Directory. Google saw agents map more than 110,000 Active Directory objects and escalate privileges. They also harvested Azure keys (GTIG ).
- Planting web shells. Agents wrote JSP web shells by poisoning MySQL's general log (GTIG ).
- Abusing old keys and weak SAML. Vapor Panda forged an admin token with keys unrotated since 2022. It also chained unsigned SAML assertions with XXE (CrowdStrike ).
How fast do ARTEX attacks move?
Very fast. Google found ARTEX went from a first account to deep access in about four hours. In one case it took 15 minutes. DIVD's latest update says its attacker went from first access to root in 12 minutes.
Speed has a cost for the attacker. Google says ARTEX trades "stealth for velocity." DIVD called its intrusion loud and messy. That noise is your best chance to catch it.
How do you detect ARTEX on your network?
Look for the footprint the vendors have published.
- Hosts or processes with "artex", "artx", or "art18-" in the name. CrowdStrike also flags the folder
C:\ProgramData\artx5v. - Outbound traffic to webhook.site and similar request-capture services. Google saw ARTEX send output to 491 of these URLs.
- The user agent
artex-enrich/1.0in web logs, which WorkOS's founder reported. - Bursts of failed sign-ins across many accounts. Also watch for new OAuth credentials, consent grants, and role changes.
If you find any of these, preserve evidence first. Microsoft warns against deleting compromised enterprise apps as a first step.
How do you defend against ARTEX today?
ARTEX doesn't use new tricks. It runs old ones faster and at scale. That means the fixes are known.
- Patch and inventory what faces the internet. ARTEX gets in through exposed apps and admin panels. Restrict control planes like Azure's Kudu/SCM. If you run Zammad, update to 7.2.2 or later or take it offline.
- Harden identity. Rate-limit sign-ins and alert on password sprays. Audit OAuth apps, consent grants, and admin role changes. ConnectWise Cloud Backup customers should follow its re-authorization guide.
- Rotate keys, including old ones. Vapor Panda used keys that had not changed since 2022. Rotate keys stored in backups too. Prefer short-lived workload credentials.
- Close the classic AD and cloud gaps. Harden AD CS and enforce SMB and LDAP signing. Reduce NTLM. Validate SAML signatures and require IMDSv2 on cloud instances.
- Run EDR everywhere and control egress. Vapor Panda's agents went looking for hosts without Falcon. Block egress to webhook services you don't use.
- Pentest yourself continuously. Run the same kind of AI testing against your own attack surface. Fix what it proves exploitable, then retest.
Why isn't a yearly pentest enough against ARTEX?
ARTEX can reach root in minutes. A yearly or quarterly pentest leaves months where new exposures go untested. Code and cloud config change every day. The gap grows with every deploy.
The fix is to test as often as attackers do. We covered the right cadence in How Often Should You Pen Test?. The short answer is continuously. As we wrote in Autonomous Attackers Are Here, defenders now need agents of their own.
How does MindFort help you defend against ARTEX-style attacks?
MindFort won't flag ARTEX traffic. It closes the gaps ARTEX looks for. Our agents continuously pen test your apps, APIs, and infrastructure on the cadence you set. Each finding is proven with a working exploit, so false positives stay under 1%.
Agents then open a patch pull request or a cloud config fix. They retest to confirm the hole is closed. We call this Autonomous Exploitation and Remediation (AXR). Multiple Fortune 500 companies and top startups already run MindFort agents. Book a demo to test your attack surface before ARTEX does.
FAQ
Is ARTEX malware?
Not at first. ARTEX was released as an open-source AI pentesting framework. Google now describes it as an offensive command-and-control platform. Attackers use it like any other dual-use hacking tool.
Is ARTEX still available?
Its developer stopped updates on October 8, 2026, and said ARTEX would become closed source. Copies still circulate. Google names a fork called ScopeWeaver and a paid version called ARTEX PRO.
Who is behind the ARTEX attacks?
Several unrelated groups. CrowdStrike links one campaign to Vapor Panda, a China-based espionage group. Microsoft tracks another as Storm-0940. The Korean bank attacker has not been named. Korean police also arrested a seven-person gang that used ARTEX.
Can MindFort detect ARTEX?
No. MindFort is not a detection tool. It continuously pen tests your apps and infrastructure and proves which flaws are exploitable. Then it helps you fix them, which removes the openings ARTEX agents look for.
About the author
Brandon Veiseh
Co-Founder & CEO · MindFort
Founded his first startup building NLP models for network packet inspection. Led product at ProjectDiscovery, built their enterprise platform from scratch. At NetSPI, led development of AI tools for offensive security.