ARTEX Agentic Offensive Framework: Architecture, Fork Ecosystem, and Multi-Actor Abuse

Bottom line: ARTEX is an autonomous, multi-agent penetration-testing framework that turns high-level goals into parallel reconnaissance, identity probing, and post-exploitation at machine speed. Adopted by state espionage groups, financial criminals, and red teams—and backdoored in a rogue Docker image pulled over 9,000 times—it requires defenders to remove public API maps, harden self-service identity flows, and detect behavioral bursts rather than static indicators.

Period covered: 2026-01-01 to 2026-11-13 · Overall confidence: High · Sources: 20 (20 primary, 0 secondary)

Key Judgments

1. ARTEX almost certainly compresses intrusion timelines from days to minutes (15 minutes to four hours) by coordinating LLM planner and worker agents over a shared asset graph rather than using novel exploits. (Confidence: High; [#1][#2][#4][#9][#17])
2. Taking ARTEX closed-source on 2026-10-08 very likely failed to curb proliferation: 12,000+ prior forks, 1,428–1,645 exposed consoles, and derivatives like ScopeWeaver keep it widely available. (Confidence: High; [#1][#3][#10][#12][#13])
3. Distinct China-nexus espionage groups (Storm-0940/UNC7228, VAPOR PANDA) and financial actors (Storm-3358, TAG-217) almost certainly operate ARTEX independently; tool artifacts alone attribute nothing. (Confidence: High; [#1][#4][#5][#6][#7])
4. Operators who pulled tomicdd/artex:latest or congdonglinux/artex:latest after 2026-10-08 are almost certainly exposed to unauthenticated root RCE and theft of stored target credentials and LLM keys. (Confidence: High; [#2][#12])
5. Static IP and user-agent blocks are very likely ineffective; durable defense requires removing public OpenAPI/source-map files, hardening OAuth and self-registration flows, and alerting on trial-and-error API cadences. (Confidence: High; [#1][#9][#10][#11])

Am I Affected?

Priority Actions

Briefing by Role

• CISO / leadership: ARTEX turns minor identity and API exposures into full cloud breaches within minutes, while a trojanized Docker image compromised red teams using it. Fund attack-surface reduction, short-lived workload credentials, and governance for internal AI pentesting tools.
• SOC: Correlate nonexistent baseline probes (/zzz-nonexistent-xyz123), 1–14 request bursts with 25–31 s LLM pauses, GET-after-write checks, and egress to webhook.site or grey-market LLM gateways rather than relying on static IPs.
• CERT / Incident Response: ARTEX workers pivot across cloud control planes, databases, and AD simultaneously, leaving noisy trial-and-error logs and incremental webshells. If an internal console used the backdoored Docker image, treat every downstream client environment stored in its database or volumes as compromised.

1. Situation Overview

Released on GitHub on 2026-07-26 by developer Autumn-27, ARTEX is a Go-based, multi-agent offensive framework that pairs large language models (LLMs) with conventional penetration-testing utilities [#3][#10]. Unlike earlier AI assistants that only drafted scripts or phishing lures, ARTEX accepts a target scope, credentials, and a high-level goal, then autonomously plans tasks, executes tools, interprets errors, and adapts attack paths until the objective is met [#1][#3][#9]. Between August and November 2026, responders across Google Threat Intelligence Group (GTIG), Microsoft, CrowdStrike, Sophos, Palo Alto Networks Unit 42, Zscaler, Recorded Future, Wiz, and Datadog documented its rapid adoption in real-world intrusions worldwide [#1][#2][#4][#5][#6][#7][#9][#11][#16].

The operational shift introduced by ARTEX is compression of time and expansion of scale, not zero-day invention [#1][#2][#9]. Across documented incidents, operators either unleashed ARTEX on internet-facing applications and APIs or fed it valid stolen credentials to automate post-exploitation [#1][#2][#11]. In campaigns tracked by GTIG (UNC7228) and CrowdStrike (VAPOR PANDA), agents progressed from initial access to deep system or cloud control in 15 minutes to four hours and attacked more than 200 organizations in parallel [#1][#4]. Separately, Storm-0940 used ARTEX to accelerate a multi-tenant supply-chain compromise of ConnectWise (SkyKick) applications in Microsoft 365 [#17]; that incident is analyzed in our dedicated report, Storm-0940 Abuses ConnectWise App Credentials to Reach Microsoft 365 Tenants with ARTEX, and is not repeated here.

Following public disclosures of abuse against South Korean financial institutions, Autumn-27 closed the repository on 2026-10-08 [#3][#10][#12]. By then, ARTEX had accumulated more than 12,000 GitHub forks [#10][#11][#16]. Within hours of the takedown, an unknown actor published a counterfeit successor repository pointing to a trojanized Docker Hub image (tomicdd/artex:latest) that contained an unauthenticated root command-execution backdoor and accumulated 9,176 total pulls before removal [#12]. As of early November 2026, between 1,428 and 1,645 ARTEX-family consoles remained exposed on the public internet [#3][#12][#13].

2. Timeline

3. Attack Flow

flowchart TD
    A["1. Operator Setup<br/>Target scope, stolen keys or URLs T1588.007"] --> B["2. Planner & Blackboard<br/>LLM decomposes goal into intents on asset graph"]
    B --> C["3. App & API Mapping<br/>Workers fetch .js.map, /openapi.json, S3 T1595"]
    B --> D["3. Identity Probing<br/>Canary baselines, OAuth fuzzing, Cognito T1110.003"]
    C --> E["4. Adaptive Exploitation<br/>SQLi, SSRF, SAML/XXE, 422 payload fixes T1190"]
    D --> F["4. Cloud & Account Abuse<br/>Self-registration, IAM/Entra role abuse T1078.004"]
    E --> G["5. Host & DB Execution<br/>MySQL log poisoning, JSP webshells, curl T1505.003"]
    F --> H["5. Lateral Movement & Evasion<br/>EDR checks, BLOODALCHEMY, WISP C2 T1518.001"]
    G --> B
    H --> B
    G --> I["6. Collection & Exfiltration<br/>CloudWatch/DB dumps, webhook.site output T1005"]
    H --> I

4. Technical Analysis

4.1 Architecture: Planner, Worker Agents, and the Asset Graph

ARTEX is written in Go and ships with an embedded Next.js operator console (default TCP port 8787, commonly also 8790, 8890, 443, and 80), backed by PostgreSQL (127.0.0.1:5435 in containerized builds) and mitmproxy for HTTP traffic capture [#1][#3][#8][#11]. Google GTIG notes that the platform divides the intrusion lifecycle across six specialized agents [#1], while Datadog, Censys, and CrowdStrike document three primary execution tiers [#3][#4][#11]:

• Primary Agent: interfaces with the human operator, accepts natural-language objectives, scope rules, and credentials, and handles human-in-the-loop approval prompts [#4][#11].
• Planner Agent: evaluates the current state, decomposes the high-level objective into discrete attack "intents," monitors task heartbeats and timeouts, and revises plans when paths fail or return errors [#2][#3][#10][#11].
• Worker Agents: three concurrent workers by default claim intents from the queue, invoke command-line tools or scripts, validate execution using structured stdout markers (such as ARTX123 or MARKER123), and write structured results back [#2][#3][#11].

Coordination occurs through a shared "blackboard" asset graph (mapping discovered hosts, subdomains, APIs, accounts, and permissions) and an exploration graph (tracking tested intents, findings, facts, and hints so workers do not repeat dead ends) [#2][#3][#4][#11]. Exposed console API routes reflect this internal architecture: /tasks, /exploration/findings, /exploration/graph, /exploration/intents, /traffic, /companies, /llm/profiles, /llm/pool, /intercept, /mcp, /skills, /agents, and /notify [#11].

Workers orchestrate standard dual-use and offensive tools rather than custom zero-days: nmap, nuclei, httpx, ffuf, sqlmap, curl, wget, netcat, Impacket (SMBExec, WMIExec), fscan, GodPotato, Invoke-TheHash, jadx, apktool, frida, Norma SDK WebFetch, and headless Chromium via Playwright [#3][#5][#8][#10][#16]. For cognitive reasoning, ARTEX connects to OpenAI Chat Completions, OpenAI Responses, and Anthropic-compatible APIs [#3][#11]. In observed intrusions, operators favored low-cost or permissive models—primarily DeepSeek (deepseek-v4.1-flash, deepseek-v4-pro), Zhipu AI GLM-5.3, and xAI Grok 4.6, alongside Claude Code and Codex—often routed through self-hosted bridges (Sub2API on port 8080, CLIProxyAPI, New API, grok2api) or grey-market API resellers (xcai[.]pro, lanmao666[.]com) to avoid provider bans and obscure attribution [#2][#3][#7][#8][#10].

4.2 Evolution: Open Source to Closed Source, Forks, and the Docker Backdoor

Within ten weeks of its 2026-07-26 release, ARTEX gained 1,500 to 2,000 stars and more than 12,000 forks [#3][#10][#11][#16]. Although early versions contained prompt/config guardrails meant to block targeting of government and university domains, those controls were easily stripped or ignored [#7][#8]. When Autumn-27 took the repository closed-source on 2026-10-08, 102 new forks and ARTEX-named repositories appeared during the takedown week alone [#13]. Rebranded and localized derivatives—including ScopeWeaver, ARTEX PRO, ARTEX MX, ARTEX v2 · Agent Security Workbench, LUCK, and Guanlan SEC Penetration Testing Platform—proliferated alongside peer frameworks such as PentAGI, CyberStrikeAI, CAIRN, HexStrike, Agent Zero, Pojun, and RedAmon [#1][#3][#9][#11][#13]. Internet-wide scans between November 3 and 7 identified 1,428 (GitGuardian/Shodan), 1,465 (Censys), and 1,645 (BadByte) exposed ARTEX consoles, concentrated in the United States, Hong Kong, and China [#3][#12][#13]. Censys noted that ~650 hosts belonged to two uniform hosting templates in AS54600 (PEG Tech, 493 hosts) and AS138415 (Yancy Limited, 157 hosts), leaving ~815 distinct deployments, while 10.6% (155 hosts) co-hosted C2 or offensive frameworks such as CyberStrikeAI, Cobalt Strike, Adaptix C2, vshell, FRP, and NPS [#3].

Hours after the 2026-10-08 shutdown announcement, an attacker executed a supply-chain hijack targeting ARTEX users [#2][#12]. At 18:50 UTC on 2026-10-08, the Docker Hub account tomicdd was created and pushed tomicdd/artex:latest at 19:41 UTC (later mirrored byte-for-byte as congdonglinux/artex:latest) [#12]. The GitHub account trhhubsd (formerly ptasm) published a clean-looking source copy (github.com/trhhubsd/ARTEX), inflated it with ~2,449 star events, closed a user issue reporting a backdoor, and altered one line in docker-compose.yml to pull tomicdd/artex [#12].

Binary diffing against upstream v0.3.15 revealed that the compiled 51.2 MB /app/artex binary (v0.3.16-0.20261008134550-5c0dbd4bec94+dirty) added a hidden server.verifyCaptcha function and a Captcha JSON field to POST /api/auth/login [#12]. Supplying a specific prefix in captcha passes the string directly to exec.Command("sh", "-c", command) as root and returns stdout/stderr before username or password checks run [#12]. Because ARTEX binds port 8787 on 0.0.0.0 as root by default, any internet-exposed container granted unauthenticated root RCE, exposing ARTEX_PG_DSN, LLM API keys, /app/jwt.key (allowing 7-day admin token forgery), mitmproxy CA private keys, and all downstream target credentials [#12]. Before Docker removed both images on 2026-11-05, they reached 9,176 pulls (7,946 prior to disclosure), with 62 confirmed backdoored consoles exposed online [#12].

4.3 Threat Actor Adoption and Operational Playbooks

• Storm-0940 / UNC7228 (China-state-aligned espionage): Active since 2021, Storm-0940 adopted ARTEX by September 2026 [#17]. GTIG's overlapping UNC7228 cluster targeted enterprise software, industrial automation, semiconductor, telecom, government, and financial sectors across the US, Europe, and Asia, moving from initial account compromise to deep access in ~4 hours (and in one case 15 minutes) [#1]. Beyond the ConnectWise M365 abuse (see the dedicated ConnectWise report), Wiz observed Storm-0940-linked infrastructure (104.194.150[.]21, 167.88.172[.]97, 144.172.64[.]0/24) running 24–30 hour ARTEX sessions against software vendors: harvesting .js.map and OpenAPI files, testing unsigned "alg":"none" JWTs across 60+ /sso* paths in two minutes, abusing password-reset and disposable-email sign-ups, and spraying software engineers at 1-second intervals [#16].
• VAPOR PANDA (China-nexus espionage): Assessed by CrowdStrike as distinct from Storm-0940, VAPOR PANDA used ARTEX with DeepSeek and a commercial LLM to attack 200+ organizations across 14 countries between 2026-10-17 and 10-28, consuming ~1.4 billion input tokens in a single intrusion [#4]. Targets spanned government ministries, defense, nuclear, semiconductor, pharmaceutical, and telecom entities [#4]. Confirmed post-exploitation at nine victims included chaining an unsigned SAML assertion with XXE to extract cloud IMDS role credentials, exploiting an unauthenticated container orchestrator to dump LAPS passwords and abuse RBCD, and forging mail-server admin tokens using unrotated 2022 directory keys [#4]. Operators issued Chinese-language prompts (UTC+8) instructing agents to identify Windows hosts lacking the CrowdStrike Falcon sensor and deployed the BLOODALCHEMY backdoor (svchost.exe sideloading graphics-hook-filter64.dll to decrypt graphics-hook_config.bin, internal path D:\ProjectX\Merman_New\) [#4].
• Storm-3358 (Cambodia-based financial cybercrime): Beginning in October 2026, Storm-3358 used ARTEX against financial institutions in Southeast Asia and globally [#5]. Agents scanned web applications for anonymous file-upload and SSRF flaws, deployed web shells, and used curl and netcat to pull open-source RATs (WISP, vshell, AdaptixC2) for lateral movement, database dumping, and cloud exfiltration [#5].
• TAG-217 and East Asian financial/vertical campaigns: Recorded Future (TAG-217) and Zscaler documented a Chinese-speaking financial operation that prepared infrastructure from 2026-08-17 (38.244.50[.]120 jump server, 23.248.226[.]250–.254 work servers) and breached at least seven South Korean financial institutions in late September 2026, stealing ~67,000–68,000 individuals' PII and loan data via SQLi and auth bypass on peripheral portals [#3][#6][#7][#8]. Recovered prompts from custom image artex-local:perf2-20261003 revealed a global 19-country campaign using multi-model peer review (DeepSeek audited by GLM and Grok, persistent context via tools/project_context_hook.py and scope.md/surface.md) and Claude Code to research Korean Telegram data markets [#7][#8]. Separately, GMO Cybersecurity identified seven ARTEX-linked attack infrastructures targeting Japanese companies by industry vertical (causing at least eight public data leaks) [#18], while Trend AI Security documented parallel Chinese-language campaigns in Japan using CyberStrikeAI (44 agents) and LLM-planned GPU/AI cluster hijacking [#19].
• Opportunistic cloud/API operators, LLM resellers, and red teams: Unit 42 and Datadog documented unattributed operators using ARTEX to self-register in production APIs (exfiltrating ~50 MB of records), execute unauthenticated PUT writes against dev APIs within 38 seconds of reading /openapi.json, mine AWS CloudWatch logs via compromised IAM keys, and abuse public AWS Cognito user pools [#9][#10][#11]. In Wiz's "Black October" investigation of nine breached AI developer platforms, an exposed ARTEX console (artex.nhhh[.]de on 23.106.46[.]239) co-existed with LLM-resale infrastructure (llm-routing[.]com) that tested stolen Amazon Bedrock keys [#20]. Finally, Censys and Cybrani confirmed that many exposed consoles belong to legitimate red teams or researchers—32 of whom accidentally left open directories exposing exploit kits and .claude histories [#3][#14][#15].

5. Cross-Source Assessment

5.1 Where sources converge

• Speed and breadth over stealth: Google GTIG, Microsoft, CrowdStrike, Sophos, Unit 42, Wiz, and Datadog all agree that ARTEX relies on conventional tools and known flaws, achieving breakthroughs by testing hundreds of paths in parallel and adapting to HTTP/SQL/compiler errors within seconds [#1][#2][#4][#9][#10][#11][#16].
• Hybrid human-in-the-loop operations: Across VAPOR PANDA, TAG-217/Zscaler, Unit 42, and Storm-0940, human operators supply initial stolen credentials, high-level prompts, or manual browser steps (such as password resets), while ARTEX automates discovery and post-exploitation [#1][#4][#8][#9][#17].
• Signature behavioral cadence: Multiple independent telemetries confirm ARTEX's calibration probes to nonexistent paths (/zzz-nonexistent-xyz123, zzz_nonexistent_abc.txt), 1–14 request bursts with 25–31 second inference pauses, and immediate read-after-write verification [#1][#9][#10][#11][#16].
• Non-attribution of the tool itself: Every primary vendor stresses that ARTEX is a widely forked dual-use framework; console fingerprints or default artifacts alone never identify a specific threat group [#1][#3][#10][#14][#15].

5.2 Where sources diverge

5.3 Intelligence gaps

• Identity of the Docker backdoor operator (tomicdd / trhhubsd): Whether the pre-authentication root backdoor was planted by an opportunistic criminal, a competing threat group, or a counter-offensive operation—and which of the 62 confirmed exposed consoles were actively exploited—remains unknown [#12].
• Actual backend LLMs behind reseller gateways: Configuration files referencing xcai[.]pro or lanmao666[.]com show requested model strings (deepseek-v4.1-flash, gpt-5), not the true model answering behind the proxy [#8][#10].
• Extent of silent data reads: Where cloud object logging or Microsoft Graph activity logs were disabled, read-only exfiltration by ARTEX workers cannot be quantified [#1][#17].

6. Attribution

ARTEX is a shared capability, not an actor signature [#1][#3][#10]. Across the 2026 research window, four named threat clusters and several unattributed groups have been documented:

• Storm-0940 / UNC7228 (High confidence in ARTEX use, Moderate confidence in cluster boundaries): Microsoft attributes the ConnectWise supply-chain campaign and broader vendor identity probing to China-state-aligned Storm-0940 [#16][#17]. Google GTIG assesses that its UNC7228 cluster overlaps Storm-0940 [#1].
• VAPOR PANDA (High confidence, CrowdStrike): Assessed by CrowdStrike as a China-nexus espionage actor distinct from Storm-0940, operating on China Standard Time (UTC+8) with Chinese-language prompts and deploying the proprietary BLOODALCHEMY backdoor [#4].
• Storm-3358 (Moderate-to-High confidence, Microsoft): Assessed by Microsoft as a Cambodia-based, financially motivated cybercrime group targeting the financial sector with ARTEX and commodity RATs (WISP, vshell, AdaptixC2) [#5].
• TAG-217 / South Korean & Global Financial Operator (Moderate confidence, Recorded Future & Zscaler): Assessed as a likely Chinese-speaking, financially motivated group based on CST timestamps, Chinese schema translations, mainland phone registration artifacts, and Korean Telegram market queries [#3][#6][#7][#8]. GMO Cybersecurity assesses that a related vertical-targeted model hit Japanese firms [#18].

7. Detection & Hunting

7.1 Retrospective hunt window

Hunt from 2026-08-15 to the present. Exposed infrastructure for TAG-217 (38.244.50[.]120) was active by 2026-08-17 [#3][#6], GTIG observed live intrusions starting in late August 2026 [#1], and Storm-0940, VAPOR PANDA, Storm-3358, and the tomicdd/artex Docker backdoor peaked between September and November 2026 [#4][#5][#12][#17].

7.2 Detection rules

Host, Database, Network, and Identity Hunting Matrix

title: ARTEX Agentic Framework Host Artifacts and Verification Markers
id: 9b4e1d7c-3a62-4f89-8c15-6d2e4f8a1b30
status: experimental
description: Detects host-level temporary directories, probe files, and command-line execution markers generated by ARTEX worker agents, or pre-auth RCE shell spawning in trojanized ARTEX containers.
references:
  - https://ti-mindmap-hub.com/report/f820dd7e-d01b-4127-8115-9f4f56fde795
  - https://ti-mindmap-hub.com/report/f4a52e8f-2e00-4c15-8d7c-f162dca645c6
  - https://ti-mindmap-hub.com/report/e3ec0068-1306-44be-9a22-6442c85aca4d
  - https://ti-mindmap-hub.com/report/a35ce6e1-20d5-42bf-a6a3-10ed055d0c4b
logsource:
  category: process_creation
  product: windows
detection:
  selection_cli:
    CommandLine|contains:
      - '\Windows\Temp\artx'
      - '\ProgramData\artx5v'
      - 'artex-probe-'
      - 'ARTX123'
      - 'MARKER123'
      - 'ArtexProbe'
      - 'art18-'
  selection_sideload:
    Image|endswith: '\svchost.exe'
    CommandLine|contains: 'graphics-hook'
  condition: selection_cli or selection_sideload
falsepositives:
  - Authorized red-team engagements using ARTEX (verify against registered testing hosts)
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
  - attack.t1574.001

title: Trojanized ARTEX Docker Container Pre-Auth Root Shell Execution
id: 4d8a2c19-7e3b-4c10-9f54-1a8b3e6d9c02
status: experimental
description: Detects the /app/artex binary spawning a Unix shell via sh -c, triggered by the hidden captcha backdoor in tomicdd/artex and congdonglinux/artex images.
references:
  - https://ti-mindmap-hub.com/report/a35ce6e1-20d5-42bf-a6a3-10ed055d0c4b
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/app/artex'
    Image|endswith: '/sh'
    CommandLine|contains: ' -c '
  condition: selection
falsepositives:
  - Unlikely in standard container operation where worker tools are invoked directly or in separate sandboxes
level: critical
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
  - attack.t1059.004

Microsoft Sentinel / Defender XDR (KQL), detecting ARTEX API/Web user agents, nonexistent calibration probes, and OpenAPI/source-map harvesting:

let artexUAs = dynamic(["artex-readonly/1.0","artex-pentest/1.0","artex-audit/1.0",
  "artex-spawn/1","artex-verify/1.0","ARTEX-worker/1.0","artex-i21861-canary",
  "Mozilla/5.0 ARTeX","ReconProbe/1.0","norma/0.4","security-testing; authorized","recon-audit"]);
let probePaths = dynamic(["/zzz-nonexistent-xyz123","/zzzrandom12345","nonexistent-i3185",
  "zz-no-such-key-1a2b3c.html","zzz_nonexistent_abc.txt","Notexist-xyz"]);
let mapPaths = dynamic([".js.map","/openapi.json","/swagger.json","/redoc","/api/auth/login"]);
W3CIISLog
| where TimeGenerated > datetime(2026-08-15)
| where csUserAgent has_any (artexUAs)
    or csUriStem has_any (probePaths)
    or csUriStem has_any (mapPaths)
| summarize Requests=count(),
    MapFetches=countif(csUriStem has_any (mapPaths)),
    CanaryProbes=countif(csUriStem has_any (probePaths)),
    DistinctPaths=dcount(csUriStem),
    UAs=make_set(csUserAgent, 10)
    by cIP, bin(TimeGenerated, 15m)
| where CanaryProbes > 0 or csUserAgent has_any (artexUAs) or (MapFetches > 0 and DistinctPaths > 15)

Microsoft Sentinel (KQL), detecting ARTEX identity baselining (zz* / nonexistent / ArtexProbe canary usernames followed by admin or OAuth redirect errors):

SigninLogs
| where TimeGenerated > datetime(2026-08-15)
| where UserPrincipalName has_any ("nonexistent","not-a-user","ArtexProbe","artex-probe","test@test.com","deadbeef")
    or UserPrincipalName startswith "zz_" or UserPrincipalName startswith "zzq."
    or ResultDescription has "illegal_redirect_uri_enhanced"
| summarize Attempts=count(), Users=make_set(UserPrincipalName, 20), UAs=make_set(UserAgent, 10)
    by IPAddress, AppDisplayName, bin(TimeGenerated, 30m)

For ConnectWise/SkyKick service-principal KQL queries and app IDs, use Section 7.2 of the Storm-0940 ConnectWise Compromise report.

7.3 Detection limitations

• Mutable LLM strings: User agents (artex-*), temporary filenames (artx*), and canary probe paths are generated by prompts or default skills that operators can override in seconds [#1][#5][#10][#11].
• Legitimate cloud and AI endpoints: Outbound traffic to api.deepseek.com, api.anthropic.com, open.bigmodel.cn, api.x.ai, or webhook.site can originate from developer workstations; alert only when seen from production servers or correlated with scanning/staging [#1][#7].
• Dual-use red-team noise: Over 1,400 exposed consoles include authorized pentesters and researchers, and CDN edges (such as Cloudflare IPs) must not be blocked as attacker origins [#3][#14].
• Passive Docker backdoor: The tomicdd/artex implant never beacons out; without inspecting inbound POST /api/auth/login payloads for captcha or child sh -c processes, exploitation blends into failed login traffic [#12].

8. Indicators of Compromise

Network indicators are defanged. All values come from the cited sources; machine-readable versions are available as STIX 2.1 bundles in TI Mindmap HUB. ConnectWise-specific Storm-0940 indicators are maintained in the Storm-0940 ConnectWise report.

VAPOR PANDA & BLOODALCHEMY espionage campaign

Storm-3358 financial sector campaign

TAG-217 / South Korean & global multi-model financial campaign

Unattributed ARTEX API, IdP, AWS, and Storm-0940 vendor-probing clusters

Trojanized ARTEX Docker supply-chain backdoor (tomicdd/artex & congdonglinux/artex)

ARTEX console hunting pivots (exposure leads, context needed before blocking)

9. MITRE ATT&CK

In addition to ATT&CK, Zscaler maps ARTEX multi-model workflows to MITRE ATLAS techniques AML.T0040 (AI Agent Tool Integration), AML.T0043 (Autonomous AI Reconnaissance and Exploitation), AML.T0048 (Multi-Model LLM Routing and Delegation), AML.T0051 (LLM Peer Review and Verification), AML.T0052 (Persistent AI Context and State Management), and AML.T0054 (AI Guardrail Bypass) [#8].

10. Sources

11. Pivot in TI Mindmap HUB

• Read the companion supply-chain analysis: Storm-0940 Abuses ConnectWise App Credentials to Reach Microsoft 365 Tenants with ARTEX
• Read the sources with their mindmaps: every row of the Sources table opens the platform report, with its summary, mindmap and extracted entities.
• Search these indicators across all reports: IoC Search · CVE Search
• Load them into your TIP or SIEM: STIX 2.1 bundles
• Ask your AI assistant about this campaign: MCP integration

Methodology & Changelog

• Method: cross-source synthesis of 20 primary reports collected by TI Mindmap HUB between 2026-01-01 and 2026-11-13, retrieved through the TI Mindmap HUB MCP server (keyword searches on ARTEX, VAPOR PANDA, Storm-3358, TAG-217, Storm-0940, BLOODALCHEMY, PentAGI, and South Korean financial, plus knowledge-graph entity searches). Duplicates, secondary rewrites, and incident-specific ConnectWise reports removed: 11 (a duplicate ingestion of the BadByte Docker backdoor report, a Spanish-language rewrite of the CrowdStrike VAPOR PANDA report, three secondary news/aggregator summaries from PolySwarm, Dark Reading, and Security Affairs, and six ConnectWise-specific incident reports already synthesized in storm-0940-artex-connectwise-cloud-compromise).
• 2026-11-13: first publication.

This report is derived from publicly available sources. It is provided for defensive purposes, as is, without warranty.