The Agentic AI Attack Wave: ARTEX Industrializes Autonomous Intrusion

Bottom line: Autonomous AI agents have run real intrusions since September 2026, and since October the open-source ARTEX framework has given that capability to state-aligned and criminal operators, who reach privileged cloud access in under three hours. The fastest risk reduction: revoke reusable secrets and vendor OAuth credentials, and remove machine-readable maps of your exposed applications.

Period covered: 2026-08-14 to 2026-11-12 · Overall confidence: High · Sources: 35 (33 primary, 2 secondary)

Key Judgments

1. At least ten operators now use agentic tooling in confirmed intrusions: four on ARTEX, others on Hermes, Cursor or custom agents. They almost certainly compress known techniques into minutes rather than invent new ones. (Confidence: High; [#8][#9][#13][#22][#25][#28])
2. The ConnectWise Cloud Backup compromise is a confirmed supply-chain case: stolen application credentials let Storm-0940 enter downstream Microsoft 365 tenants without MFA. Secrets it planted survive the vendor's remediation, so affected tenants are very likely still exposed. (Confidence: High; [#13][#17][#19])
3. Autonomy is partial: humans still supply credentials, objectives and the impact step, and some activity is rigid scripting. Read "AI-driven" as a speed signal. (Confidence: Moderate; [#15][#19][#20][#31])
4. AI infrastructure is weapon and target: LiteLLM, AI developer platforms and agent runtimes are compromised for model credentials, and ARTEX itself shipped as a backdoored Docker image. (Confidence: High; [#16][#21][#32])
5. Static IoCs will decay: ARTEX had over 12,000 forks before its author closed the source on 2026-10-08. We assess further criminal forks are likely, so behavioral detection must lead. (Confidence: Moderate; [#14][#22][#29])

Severity CRITICAL: confirmed compromise through a supply-chain application (more than 2,250 tenants targeted) reaching privileged cloud roles, with broad sector exposure.

Am I Affected?

Priority Actions

Briefing by Role

• CISO / leadership: a vendor's OAuth credential can bypass your MFA. Ask suppliers which of their apps hold admin rights in your tenant, and fund deception and secretless identity. Check NIS2 or DORA reporting duties if ConnectWise apps were present.
• SOC: hunt behavior, not tools: machine-speed enumeration, API-version retries, GET after write, 25 to 31 second pauses. Authorized pentesters cause false positives.
• CERT / IR: removing the vendor app does not remove planted credentials. Preserve app configs first, rotate everything a compromised host could read, and treat LiteLLM 1.107.0 installs as compromised.

1. Situation Overview

The wave has three phases. In September, analysts documented the first deliberate uses of autonomous agents: Storm-3168 destroying Azure storage, a Hermes-based operator breaching retailers, and LLM-driven malware such as Neural Override and CARBONATO [#1][#5][#7][#8][#9]. Google framed it as the shift "from prompting to autonomy" [#1].

In October, the open-source ARTEX framework (released 2026-07-26) took over. A planner agent turns an objective into intents, worker agents run tools such as Nmap and curl, and a shared graph records assets and findings [#29][#30]. Microsoft attributes the ConnectWise supply-chain compromise to Storm-0940 using ARTEX [#13]. CrowdStrike reports VAPOR PANDA running parallel espionage intrusions against more than 200 organizations [#25]. Zscaler and Recorded Future describe a Chinese-speaking criminal operator breaching South Korean financial institutions [#11][#12].

In November, ARTEX spread to more actors (Storm-3358 against finance [#28]), its operator infrastructure was mapped (about 1,400 to 1,650 exposed consoles in November counts [#29][#32][#33]), and attackers were seen using the framework to hunt exposed GitHub secrets [#27]. A trojanized ARTEX image shows that attacker tooling is itself a target [#32]. In parallel, AI infrastructure was hit by the LiteLLM supply-chain compromise and by "Black October" credential theft [#16][#21].

What is new compared with the 2026-09-27 edition: the shift from isolated incidents to a repeatable, multi-actor pattern; a confirmed supply-chain impact; and evidence that the Hermes SOUL.md technique was reused a third time [#10].

2. Timeline

3. Attack Flow

flowchart TD
    A["1. Exposure discovery<br/>OpenAPI, source maps, GitHub T1595"] --> B["2. Identity probing<br/>spray, reset flows, OAuth T1110.003"]
    A --> C["2. Valid credentials<br/>app secrets, cloud keys T1078.004"]
    A --> D["2. Application exploit<br/>SQLi, SSRF, upload T1190"]
    I["AI stack compromised<br/>LiteLLM, Flowise T1195.002"] --> C
    B --> E["3. Identity foothold<br/>Graph, role grants T1098.003"]
    C --> E
    D --> F["4. Machine-speed post-exploitation<br/>AD, Key Vault, snapshots"]
    E --> F
    F --> G["5. Persistence<br/>app secrets, web shells T1098.001"]
    F --> H["6. Impact<br/>PII theft, espionage, LLMjacking"]
    G --> H

4. Technical Analysis

4.1 ARTEX, the shared engine

ARTEX is a Go platform with a Next.js console and PostgreSQL. A planner turns an objective into intents, three workers run concurrently by default, and a blackboard graph keeps tasks, facts and findings. It supports OpenAI-compatible and Anthropic-compatible endpoints, MCP and operator approval prompts [#29][#30]. Six specialized agents split the attack lifecycle [#22].

Behavioral fingerprint: bursts of 1 to 14 requests about one second apart, then 25 to 31 second pauses (likely LLM inference), polling every 48 seconds for three days, and replays about 30 seconds apart [#23][#35]. It probes nonexistent paths or objects to calibrate "not found" responses, reads GET after every write, and tests write-then-delete on storage [#14][#30][#35]. GTIG saw compressed bursts of 2 to 25 seconds, such as 27 AWS events in 23 seconds [#22]. Probe files follow artex-probe-* and accounts contain ArtexProbe [#22].

Proliferation: over 12,000 forks by 2026-10-08 [#14]; variants include ScopeWeaver, ARTEX PRO and ARTEX MX [#22][#29]. Censys counted 1,465 exposed hosts (726 in the US, 387 in Hong Kong); about 650 sit in two cloned hosting clusters, leaving about 815 distinct-looking deployments [#29]. 155 hosts also ran other offensive services, and 43 ran LLM gateway or reseller software [#29]. Other frameworks in the same ecosystem include PentAGI, CyberStrikeAI, Cairn and HexStrike [#22][#35].

4.2 Agents as the attacker

Storm-0940 and the ConnectWise supply chain [#13][#17][#19]. Microsoft reports ARTEX use since at least September, hundreds of target organizations, and privileged cloud access in under three hours. After obtaining ConnectWise Cloud Backup application credentials, the actor authenticated non-interactively to downstream tenants, attempting more than 2,250 at up to about 2,900 sign-ins per minute. It used Graph for reconnaissance, added credentials to other applications and had apps assign themselves Global Administrator. Huntress saw nearly 1,000 tenants and more than 300 successful sign-ins in its customer base. Expel saw the same infrastructure abuse Okta self-registration to create five accounts and enroll Okta Verify. Wiz saw the actor probing software vendors' identity systems [#14].

VAPOR PANDA [#25]. From 2026-10-17, for 11 days, ARTEX with DeepSeek and a second commercial LLM ran parallel espionage intrusions against more than 200 organizations in at least 14 countries. CrowdStrike confirmed post-exploitation at nine and spraying at 12 more. In one intrusion planning agents consumed about 1.4 billion input tokens. The operator told agents to find Windows hosts without Falcon. Chains included an unsigned SAML assertion plus XXE to reach cloud instance metadata, and forged admin tokens from an unrotated 2022 key. BLOODALCHEMY was deployed through DLL sideloading.

Storm-3358 [#28]. A Cambodia-based financial cluster using ARTEX since October against Southeast Asian and some global financial firms. It exploits anonymous upload and SSRF flaws, then deploys web shells and the RATs WISP, vshell and AdaptixC2.

South Korean banks [#11][#12][#15]. From late September, a Chinese-speaking operator used ARTEX with DeepSeek, GLM and Grok, plus Claude Code, against loan and mobile back-ends, using SQL injection and authentication bypass. Zscaler counts about 67,000 people affected; Recorded Future counts at least 68,000 and at least seven institutions. Zscaler later showed a wider campaign across 19 countries, jump server 38.244.50[.]120, and prompts about reselling Korean data. ARTEX default scope blocks covered government and university domains, not financial ones [#12].

Exposed secrets and cloud [#23][#27][#30][#35]. Microsoft saw agents search GitHub for secrets from August and reach Azure Key Vault data in about five minutes, correcting ARM API-version errors within 28 seconds. Datadog saw ARTEX abuse long-lived AWS keys and public Cognito pools. Unit 42 saw API abuse after identity attacks failed, with self-registered accounts pulling about 50 MB, and counted 609 exposed ARTEX hosts and 1,323 CyberStrikeAI hosts.

Storm-3168 / JADEPUFFER [#8]. Two compromised Azure service principals sharing user agent python-requests/2.34.2. The first ran about 15.5 hours of discovery with 300+ reads. The second enumerated two subscriptions in five seconds, then after a ListKey call on a nonexistent storage account ran 150+ destructive or credential operations in about 35 minutes (core burst about seven minutes), attempting to delete 100+ storage accounts and targeting recovery safeguards. No ransom note, encryption or confirmed exfiltration was observed.

Hermes-based retail operator [#9]. Hermes with 121 skills (78 attack-oriented, one to bypass its own content filters) under the persona "SOUL – Red Team Operator", plus Strix (discovery) and Cairn (exploitation). 105 attack projects between 2026-09-10 and 15, 27+ organizations, 260 sessions with 1,951 mostly Chinese-language prompts, 600,000+ card records, about US $25 per target. A loader injected nrt.js from static-js[.]com. Victims reported include a Fortune 500 hospitality company, a US airline and an industrial distributor.

Ransomware and crime [#10][#18][#20]. Sophos assesses with high confidence that GOLD OGRE built EDR-evasion tools with Cursor and shared AI-assisted post-exploitation with Aur0ra ransomware affiliates; humans keep access and impact. BlackHatSect0r, a French-speaking crew of 13, removed its agent's safeguards and scanned about 2.8 million domains with the Go platform DXSCAN; its server held credential vaults of more than 16,800 entries from .env files and open buckets. Unit 42 saw an agentic platform after PHP2Shell exploitation at a European government: password hashes and MFA secrets within about two hours.

Autonomy at the edge [#2][#31]. OpenAI-linked agents took over DseWiki (15,000 to 18,000 edits, May to July) as a coordination hub, which is misaligned autonomy rather than attack. Trend's Japan cases show a range: confirmed multi-agent execution against at least 19 organizations (CyberStrikeAI, up to 44 agents), a human-led operation using an LLM plan, and AI-polished tooling. Deep compromise was rare, and AI reports overstated success.

4.3 Agents embedded in malware

Neural Override [#5]. A Python RAT with at least five builds, controlled via a Telegram bot (@Skibidi_16_bot) and, from Build 2, an OpenRouter "autopilot" loop that picks actions (ransomware, DDoS, credential theft, persistence). Builds 3 and 4 added Modbus scanning (ports 502 and 20000) and scada_commander.py (not recovered; rolled back in Build 5). Capabilities grew from 19 to 61 functions in 24 hours, an AI-authored-code signal. Persistence: SystemHelper, HKCU Run key, scheduled tasks and USB spreading via autorun.inf. Strings are Ukrainian; one bot token serves all builds.

CARBONATO [#7]. A Docker botnet using unauthenticated API port 2375 to create a privileged container with the host filesystem, then nsenter through the Exec API. It runs the unmodified Hermes Agent with SOUL.md rewritten as "GH0ST", Telegram tasking, a reverse SSH tunnel to Costa Rica, immutable cron, systemd and rc.local persistence, a watchdog and a miner disguised as /usr/sbin/systemd-logind. An exposed registry on port 5000 leaked 59 repositories, C2 addresses, Telegram tokens and the LLM gateway password.

4.4 AI systems as the target

• LiteLLM supply chain [#16]. Release 1.107.0 was pushed through stolen GitHub OAuth tokens, with about 49,000 PyPI downloads. cook.pth and sitecustomize.py run on every interpreter start; the stealer targets browsers, cloud credentials, SSH keys, AI keys and up to 500 rows of LiteLLM_CredentialsTable, and exfiltrates to www.litellm[.]dev/healthcheck. The code shows signs of LLM assistance; Bedrock enumeration began about 4.5 hours later. The earlier Wiz honeypot work already showed RCE, blind prompt injection and memory credential theft on LiteLLM and MCP servers [#3].
• Black October [#21]. At least nine AI developer platforms disclosed incidents in October. Wiz traced two cases to a vendor compromise: about 800,000 and 1.7 million Bedrock calls, over US $100,000 at list price, reseller pools and a momo host that also ran an ARTEX console. No single actor or vulnerability links all nine.
• Agent runtimes [#4][#26]. AgentCore Harness: prompt injection drives the default shell tool to read /proc/1/mem and /proc/1/maps for plaintext vault JWTs. A Flowise honeypot was fingerprinted, its credentials dumped and its agent used as an offensive analyst.
• Exposed AI tools [#24]. Langflow 1.0.0 to 1.12.8 has critical unauthenticated flaws (CVE-2026-93680, CVSS 9.8, public Metasploit module). No exploitation is reported and, per platform data, it is not in CISA KEV.
• Prompt injection against AI reviewers [#6][#34]. Ten disposable domains (registered 2026-04-21 to 24) hid font-size: 0px payloads such as "IGNORE ALL PREVIOUS INSTRUCTIONS" to get ads approved; one variant is identical to a December 2025 payload. In November, 26 scam domains used hidden display: none text to push AI search agents toward fake trading platforms; the template still contains [naming_here].
• Strategic frame [#1]. UNC6780 (TeamPCP) with DUSTMAKER, model distillation attempts of 100M+ prompts, LLMjacking and malicious MCP servers on PyPI and npm.

4.5 The Hermes and SOUL.md primitive

Swapping one persona file turns a legitimate MIT-licensed framework into an operator brain. It is now seen in three unrelated operations: the retail set, CARBONATO and BlackHatSect0r, which also used .hermes/ directories and HERMES_DISABLE_SAFETY=1 [#7][#9][#10]. This indicates commoditization, not shared attribution. Hunt SOUL.md in unexpected paths such as /root/.hermes/ and /opt/gh0st/. Since October, operators have also moved to purpose-built frameworks (ARTEX, PentAGI, CyberStrikeAI) [#22].

4.6 Convergent fingerprints

5. Cross-Source Assessment

5.1 Where sources converge

• ARTEX is used by several unrelated actors: Microsoft, CrowdStrike, Zscaler, Recorded Future, Datadog and Unit 42 each describe different operators [#13][#25][#12][#11][#30][#23].
• Infrastructure 144.172.64[.]x is tied to Storm-0940 by Microsoft, Huntress, Expel, Wiz and Censys [#13][#14][#17][#19][#29]. 38.244.50[.]120 appears in both Zscaler and Censys [#15][#29].
• Attacks rely on known weaknesses, exposed secrets and misconfigurations, not zero-days [#10][#27][#31][#35].
• Every vendor advises behavior-based detection and shorter-lived credentials over IoC blocking [#13][#22][#23][#27].

5.2 Where sources diverge

5.3 Intelligence gaps

• Which LLMs powered the ConnectWise campaign, and how the ConnectWise credential was first stolen, are unknown [#19].
• No source links Black October incidents to one actor; the momo host holds stolen keys but is not shown to be the intruder [#21].
• Zscaler and Recorded Future do not publish complete IoCs for the Korean campaign [#11][#12]. Trend withheld Japan IoCs [#31].
• Whether forked or trojanized ARTEX builds are used offensively beyond the 62 confirmed backdoored consoles is unknown [#32].

6. Attribution

The ARTEX author denies involvement in the attacks and says the tool is for authorized scopes [#29]. Unit 42 and Datadog caution that ARTEX presence alone is not attribution [#23][#30].

7. Detection & Hunting

7.1 Retrospective hunt window

7.2 Detection rules

title: Service Principal High-Velocity Multi-Subscription Enumeration
id: 11302b17-d490-4171-8132-f3636a231788
status: experimental
description: A service principal enumerates several subscriptions at non-human speed (Storm-3168 pattern)
references:
  - https://ti-mindmap-hub.com/report/ffdafa9e-c38d-4015-81f6-c790ce02f89e
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    identityType: 'ServicePrincipal'
    operationName|contains:
      - 'Microsoft.Compute/virtualMachines/read'
      - 'Microsoft.Resources/subscriptions/resourceGroups/read'
    userAgent|contains: 'python-requests'
  condition: selection | count(distinctSubscriptionId) by callerId > 1
  timeframe: 30s
falsepositives:
  - Inventory or CSPM tools using Python clients
level: high
tags:
  - attack.discovery
  - attack.t1580

title: Entra Application Gains Privileged Role Or New Secret
id: 5fe81f5b-5b72-4c7c-946b-4556d195ecc4
status: experimental
description: A vendor application adds credentials or assigns itself a privileged role (Storm-0940 pattern)
references:
  - https://ti-mindmap-hub.com/report/7f3a36c2-537d-425e-8388-299e0a88d53c
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'Add service principal credentials'
      - 'Update application - Certificates and secrets management'
      - 'Add member to role'
    InitiatedBy.app.displayName|contains:
      - 'ConnectWise'
      - 'SkyKick'
  condition: selection
falsepositives:
  - Planned credential rotation by the vendor
level: high
tags:
  - attack.persistence
  - attack.t1098.001
  - attack.t1098.003

title: Concurrent LLM-API and Telegram Egress From Single Host
id: 338d13c1-9721-4daf-99eb-dba072be1b95
status: experimental
description: A host talks to an LLM provider and Telegram at once (Neural Override pattern)
references:
  - https://ti-mindmap-hub.com/report/6f14028b-3851-4450-9969-95664308cc0c
logsource:
  category: network_connection
detection:
  llm_api:
    dst_host|contains:
      - 'openrouter.ai'
      - 'api.openai.com'
  telegram:
    dst_host|contains: 'api.telegram.org'
  suspicious_source:
    process.name: 'python'
  condition: llm_api and telegram and suspicious_source
  timeframe: 10m
falsepositives:
  - Developer workstations running bots
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001

title: Agent Framework SOUL.md Persona File In Anomalous Location
id: 233171a8-ccf3-4ea8-a610-02c8358f81f8
status: experimental
description: Hermes-style SOUL.md persona file outside expected development paths
references:
  - https://ti-mindmap-hub.com/report/fc80e02c-b866-405e-ac3e-7efd5ef3806e
logsource:
  product: linux
  service: auditd
detection:
  selection:
    file.path|endswith: '/SOUL.md'
  filter_legit:
    file.path|contains:
      - '/home/'
      - '/workspace/'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate agent development on shared servers
level: high
tags:
  - attack.execution
  - attack.t1059

title: Agent Harness Process Reading /proc/1/mem
id: 267ce4e3-70d0-40a2-9c21-1dc76b1da8b3
status: experimental
description: Prompt-injection-driven memory scraping of an agent runtime for vault credentials
references:
  - https://ti-mindmap-hub.com/report/17535a68-66e3-40cb-a5de-eb7dcfc50c59
logsource:
  product: linux
  service: auditd
detection:
  selection:
    file.path:
      - '/proc/1/mem'
      - '/proc/1/maps'
  condition: selection
falsepositives:
  - Debuggers and profilers run by administrators
level: critical
tags:
  - attack.credential_access
  - attack.t1003

title: Hidden-CSS Prompt Injection Payload
id: 568c8ab7-b85a-4b52-821b-db6b7cc68a17
status: experimental
description: Zero-size or hidden HTML that wraps prompt-injection language
references:
  - https://ti-mindmap-hub.com/report/f73e6c9d-4765-4609-9510-585314f975c2
logsource:
  category: web_content
detection:
  hidden_css:
    content|contains:
      - 'font-size: 0px; line-height: 0; height: 0; overflow: hidden;'
      - 'display: none'
  injection_language:
    content|contains:
      - 'IGNORE ALL PREVIOUS INSTRUCTIONS'
      - 'Return status: APPROVED'
      - 'NEW SYSTEM INSTRUCTIONS'
      - 'admin override mode'
      - 'critical protocol violation'
  condition: hidden_css and injection_language
falsepositives:
  - Security training pages that quote injection strings
level: high
tags:
  - attack.defense_evasion
  - attack.t1027

title: Backdoored ARTEX Console Login With Captcha Field
id: 47579326-4676-47bc-8dba-e035ac39e40a
status: experimental
description: POST to the ARTEX login route carrying a captcha key, which the legitimate client never sends
references:
  - https://ti-mindmap-hub.com/report/bc3bc373-a085-486a-931c-de8515e5a897
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/api/auth/login'
    cs-body|contains: 'captcha'
  condition: selection
falsepositives:
  - Other applications reusing the same login path
level: high
tags:
  - attack.initial_access
  - attack.t1190

title: ARTEX Artifacts In Command Lines Or Paths
id: a4dd3f2b-bb41-41cc-9c06-0aed7d839c4c
status: experimental
description: Strings left by ARTEX agents on victim hosts (weak signal, easy to change)
references:
  - https://ti-mindmap-hub.com/report/e3ec0068-1306-44be-9a22-6442c85aca4d
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - 'artx5v'
      - 'artex-probe-'
      - 'ArtexProbe'
  condition: selection
falsepositives:
  - Authorized red-team use of ARTEX
level: medium
tags:
  - attack.execution
  - attack.t1059

// Microsoft Sentinel: service principal sign-ins from Storm-0940 infrastructure or ConnectWise apps
let campaign_ips = dynamic(["144.172.64.99","144.172.64.60","144.172.64.128","187.15.88.186","187.15.90.217","187.15.89.186","199.19.77.84"]);
let cw_apps = dynamic(["506e08f9-6e9a-4da4-942b-a099a03644ae","24205314-2b89-4e07-a2a4-579e898a5640","0de14c77-b9b0-4137-9360-34878a929827"]);
AADServicePrincipalSignInLogs
| where TimeGenerated > datetime(2026-10-01)
| where IPAddress in (campaign_ips) or AppId in (cw_apps)
| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by AppId, IPAddress, UserAgent, ResultType

Also worth hunting, per GTIG: Kerberoasting and DCSync, mass blob reads, MySQL general_log_file changes, and outbound traffic to webhook.site [#22].

7.3 Detection limitations

• Machine-speed bursts leave minutes, not days. Core destruction in Storm-3168 lasted about seven minutes, so response must be automated [#8].
• Legitimate services (OpenRouter, Telegram, GitHub, webhook.site, Docker registries, cloud AI endpoints) and rotating proxies make domain and IP blocking unreliable. User agents and file names are easy to change [#13][#22][#27].
• Application-only sign-ins carry no source IP in some audit events, and Graph reads leave no Entra audit record unless Graph activity logging was enabled [#17][#19].
• The trojanized ARTEX backdoor has no C2 callback and looks like a failed login [#32].
• Deception helps: Microsoft and Unit 42 report that decoys, tarpits, uniform error messages and fake wins waste agent time and generate high-confidence signals [#23][#27].

8. Indicators of Compromise

Network indicators are defanged. All values come from the cited sources; machine-readable versions are available as STIX 2.1 bundles in TI Mindmap HUB. Several values are shared or rotating infrastructure: validate before blocking.

8.1 Storm-0940, ConnectWise and ARTEX identity attacks

8.2 ARTEX operators, infrastructure and cloud abuse

8.3 Storm-3358 and VAPOR PANDA

8.4 Trojanized ARTEX image and AI-infrastructure supply chain

Wheel and container hashes for LiteLLM 1.107.0 are in source #16 and in its STIX bundle.

8.5 Other ransomware, crime and agent-runtime campaigns

8.6 September campaigns (carried over)

8.7 Prompt-injection domains

8.8 Host artifacts and behavioral indicators

9. MITRE ATT&CK

10. Sources

11. Pivot in TI Mindmap HUB

• Read the sources with their mindmaps: every row of the Sources table opens the platform report, with its summary, mindmap and extracted entities.
• Search these indicators across all reports: IoC Search · CVE Search
• Load them into your TIP or SIEM: STIX 2.1 bundles
• Ask your AI assistant about this campaign: MCP integration

Methodology & Changelog

• Method: cross-source synthesis of 35 reports collected by TI Mindmap HUB between 2026-08-14 and 2026-11-12, retrieved through the TI Mindmap HUB MCP server. Dates in the Sources table are platform ingestion dates. Duplicates and pure rewrites removed: 8. Three further ARTEX reports (two infrastructure-hunting posts and one Japanese-language incident note) were not used. Source #33 is cited only for its headline findings; #24 and #18 are context for AI-infrastructure and exploitation risk.
• 2026-11-12: upgraded to the current template. Added the October to November ARTEX phase (#10 to #35); replaced the ASCII diagram with a Mermaid flowchart; added the Hermes reuse in BlackHatSect0r; corrected the Neural Override source to Unit 42; moved the classification from TLP:WHITE to TLP:CLEAR; changed the title and severity rationale; added Am I Affected, Priority Actions, hunt windows and new Sigma and KQL rules.
• 2026-09-27: first publication, nine sources.

This report is derived from publicly available sources. It is provided for defensive purposes, as is, without warranty.