The FBI has warned that hackers are using ARTEX AI agents to automate network attacks, with some intrusions reaching privileged access in under three hours.
Its November 13, 2026, FLASH alert describes how attackers combine stolen credentials, exposed applications, and cloud permissions to shorten the gap between discovery and compromise.
ARTEX is an open-source security testing framework, not a malware family. Written in Go, it connects external large language models to agents that turn instructions into commands.
Operators set objectives while agents scan targets, run tools, review results, and adjust failed steps with limited human input throughout an attack campaign.
ARTEX Accelerates Enterprise Attacks
As covered in Cybersecuritynews.com’s ARTEX enterprise attack analysis, the framework links familiar weaknesses rather than relying on a single new exploit. Agents can investigate cloud permissions, map Active Directory, and test access paths. Google observed individual automated bursts lasting two to 25 seconds, leaving defenders little time to assess connected events.
The FBI lists attacks involving SQL injection, missing API authentication, exposed passwords, and abuse of trusted cloud connections. After entry, agents have added credentials to existing applications, deployed web shells, and attempted credential theft. Other activity included searching for Windows systems without endpoint protection and mapping over 110,000 directory objects.
Microsoft previously linked ARTEX to Storm-0940, a China-state-aligned group targeting Microsoft 365 environments through compromised ConnectWise application credentials.
Attackers attempted access to more than 2,250 tenants using permissions customers had already approved. That number measures targeting, not confirmed breaches, and successful sign-ins alone do not establish customer data theft.
The FBI advisory brings these findings together, warning that ARTEX also targets overlooked supplier portals, sales tools, and mobile backends. Its under-three-hour figure describes some observed intrusions, not a fixed capability. Publicly exposed consoles exceeded 1,600 by early November, although exposed installations do not automatically prove malicious use by their operators.
A separate WorkOS breach report shows the risk to internal business applications. WorkOS detected unauthorized access to a sales application containing customer contact details and conversation records, including Slack excerpts. Its CEO identified ARTEX involvement, while the company reported no evidence that production services or WorkOS application data were affected.
Another Microsoft investigation documented ARTEX agents searching GitHub for exposed secrets. In one case, an agent progressed from repository searches to stealing Azure Key Vault data within five minutes. The activity illustrates how leaked application credentials can become cloud access, particularly when those identities hold broad permissions across connected services.
Researchers also examined servers exposed by an operator linked to South Korean financial attacks. The files revealed AI routing tools, reusable instructions, proxy services, and stored credentials. Those attacks affected roughly 67,000 people. However, shared ARTEX use does not establish that this operator, Storm-0940, and the WorkOS attacker were connected.
What Security Teams Should Monitor
The FBI recommends restricting exposed administration tools, reducing application permissions, and scanning repositories for secrets. Defenders should connect unusual application sign-ins with credential additions, role changes, and rapid API activity.
| Attack phase | Observed tactics, techniques, and procedures | Relevant MITRE ATT&CK techniques |
|---|---|---|
| Reconnaissance and cloud discovery | Scanned web directories, mapped exposed systems, tested stolen cloud credentials, and checked Azure and AWS permissions through rapid requests and validation tests. | T1595 – Active Scanning T1580 – Cloud Infrastructure Discovery T1087.004 – Cloud Account Discovery T1526 – Cloud Service Discovery |
| Initial access | Exploited SQL injection, missing API authentication, unsafe file uploads, and other web application flaws. Used leaked passwords, stolen VPN details, and compromised supplier credentials. | T1190 – Exploit Public-Facing Application T1078 – Valid Accounts T1133 – External Remote Services T1199 – Trusted Relationship |
| Supply chain compromise | Abused third-party application access and trusted cloud connections to reach customer environments through a compromised provider. | T1195 – Supply Chain Compromise T1199 – Trusted Relationship |
| Execution and persistence | Deployed JSP and PHP web shells, executed commands through Kudu administration APIs, installed remote access tools, and added credentials to existing OAuth applications. | T1505.003 – Web Shell T1059 – Command and Scripting Interpreter T1105 – Ingress Tool Transfer T1098.001 – Additional Cloud Credentials |
| Privilege escalation | Launched cloud instances with powerful roles, created administrator accounts, accessed cloud metadata, and forged administrator tokens using unchanged authentication keys. | T1098.003 – Additional Cloud Roles T1552.005 – Cloud Instance Metadata API T1606 – Forge Web Credentials |
| Internal discovery | Ran PowerShell queries against domain controllers, mapped more than 110,000 Active Directory objects, and identified Windows systems without endpoint security coverage. | T1059.001 – PowerShell T1087.002 – Domain Account Discovery T1518.001 – Security Software Discovery |
| Lateral movement | Attempted to reach domain controllers using stolen authentication material, Pass-the-Hash, Pass-the-Ticket, and Windows Remote Management. Endpoint protection blocked some attempts. | T1550.002 – Pass the Hash T1550.003 – Pass the Ticket T1021.006 – Windows Remote Management |
| Data collection and staging | Queried backend databases, read cloud storage and mailboxes, accessed cloud secrets, and created storage volumes to prepare stolen data for transfer. | T1530 – Data from Cloud Storage T1114.002 – Remote Email Collection T1555.006 – Cloud Secrets Management Stores T1074.002 – Remote Data Staging |
| Command and control | Routed traffic through residential proxies, Tor, SOCKS proxies, and compromised relays. Used Chisel and SoftEther to tunnel connections. | T1090 – Proxy T1090.003 – Multi-hop Proxy T1572 – Protocol Tunneling T1071.001 – Web Protocols |
Preserve evidence during containment, investigate secondary access paths, and validate historical indicators against current logs before blocking shared cloud infrastructure.
| Indicator | Type | Reported role or activity | Campaign / observation window |
|---|---|---|---|
38.244.50[.]120 | IPv4 address | ARTEX host with an exposed directory | South Korean financial campaign |
144.172.64[.]60144.172.64[.]99144.172.64[.]128 | IPv4 addresses | Sign-ins and Microsoft Graph API activity in customer environments | ConnectWise-related campaign |
187.15.88[.]186187.15.90[.]217187.15.89[.]186 | IPv4 addresses | Transient VPN addresses used for Graph API access through compromised applications | October 15–16, 2026 |
101.53.80[.]20205.214.59[.]31124.155.252[.]63154.201.79[.]24623.248.249[.]9023.158.220[.]98103.248.148[.]84203.160.133[.]172209.209.85[.]38 | IPv4 addresses | Proxy infrastructure | South Korean financial campaign |
199.19.95[.]66199.19.95[.]67199.19.95[.]68 | IPv4 addresses | WISP command-and-control nodes | Storm-3358 campaign, reported active as of November 6, 2026 |
91.92.240[.]23885.11.168[.]45178.16.54[.]12931.77.229[.]35 | IPv4 addresses | ARTEX servers | Storm-3358 campaign, reported active as of November 6, 2026 |
85.11.167[.]52 | IPv4 address | Command-and-control server | Storm-3358 campaign, reported active as of November 6, 2026 |
xcai[.]pro | Domain | LLM API reseller used in the campaign, not identified as a dedicated command-and-control domain | South Korean financial campaign |
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
