Researchers uncovered hundreds of openly available Artex copies online

Researchers uncovered hundreds of openly available copies of Artex, a Chinese-built open-source autonomous penetration-testing tool, sitting exposed on the internet with no password required.

Internet scanning company Censys counted more than 800 Artex deployments reachable online without requiring a password. The tool is open-source and free to download, built to run on operators’ own servers after a public release in July. “not all exposed Artex instances are used maliciously: some may be used by authorized security testing specialists,” said Censys researcher Silas Cutler, who added that since the software can operate without open internet access, it remains unclear why hundreds of systems sit exposed publicly.

Microsoft said Artex works as a system of AI agents able to carry out cyber attacks from reconnaissance through data theft with little human oversight. Itnews described Artex as a harness rather than an AI model, software wrapped around a large language model to supply a command shell, a shared discovery record, and a planner that splits intrusions into tasks handled by many agents. Documentation indicates it can link to Anthropic and OpenAI models or any service using OpenAI’s interface, Itnews also reported.

The tool has long served penetration testing, the practice of hacking an internal IT environment to uncover weaknesses that a real attack could exploit. The Epoch Times reported that creators built it to help security professionals test systems for weaknesses, and that it uses AI to plan operations, direct tools, and seek network access with limited human intervention.

Microsoft Threat Intelligence said attackers use Artex and other agentic AI frameworks to scan public code repositories for exposed secrets and API keys. Attackers have used different agentic frameworks to search GitHub for secrets since August. Those searches asked for targeted organization names, secret keywords, cloud-service-linked keywords, and terms tied to other AI service providers. Attackers then use the stolen credentials in downstream strikes against targeted organizations.

Starting October 28, researchers saw one IP address authenticating to downstream tenants using compromised but still-valid application credentials. In one case, attackers took credentials and extracted data from Azure Key Vaults and Storage Accounts, while also abusing Azure AI services. Researchers additionally saw hackers insert shell commands into a user agent to exploit vulnerabilities and attempt to seize App Service authentication tokens.

Microsoft researchers said the activity overlaps with Todyl research published on Wednesday that involved stolen Entra ID secrets used to sign in to Microsoft 365 and Azure environments at managed service providers. Microsoft researchers told organizations to treat any exposed secrets found in a public repository as compromised.

Microsoft said Storm-0940, a China state-aligned actor tracked since 2021, carried out a supply chain compromise of ConnectWise Cloud Backup. “Nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations,” said Manny Rivelo. The Hacker News reported that Storm-0940 used ARTEX to accelerate reconnaissance and scanning, password spraying, and abuse of OAuth applications at downstream targets. Starting in September 2026, the actor ran the AI tool at machine speed to conduct attacks against hundreds of organizations worldwide across multiple sectors.

Targeted sectors include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits. In some cases, intruders reached privileged cloud access within three hours of first targeting an organization. Artex was also used in an earlier October attack targeting IT support provider ConnectWise. Microsoft said China-linked hackers used the tool to break into customers’ cloud environments and steal data, leaving defenders little time to detect and respond.

Between October 10 and 14, 2026, infrastructure at IP address 144.172.64[.]99 linked to Storm-0940 ran an automated cross-tenant password-spray campaign against 327 accounts at eight organizations to access Microsoft 365 and Exchange Online. Microsoft recorded more than 151,000 failed logon events during that period. The failure rate peaked at 2,900 per minute on October 11, with more than 111,000 failures logged in one day. No successful logins, token issuance, Graph calls, or directory changes were detected during that period.

During the ConnectWise incident, Storm-0940 tried to access more than 2,250 tenants at a rate of up to 2,900 sign-in attempts per minute. On October 15, 2026, AI agents accessed the identities of many ConnectWise cloud applications and started using them to authenticate to customer environments. After taking control of many ConnectWise cloud application identities, the AI agents continued authenticating to customer environments from the same IP range using stolen app credentials and established trust.

In some cases, the AI agents moved past authentication into Microsoft Graph and directory operations, including reconnaissance, credential changes for persistence, and changes to identities, groups, and privileged roles. Microsoft said credential changes made by Storm-0940’s agents can create persistence across other identities, credentials, and cloud services and may stay active as a backdoor after administrators remediate the original application. Microsoft said it has observed threat actors in many geographic regions weaponizing the ARTEX framework.

Recorded Future Insikt Group tracks the South Korean financial attacks cluster as TAG-217 and identified related activity starting August 17, 2026, including infrastructure testing and internet scanning. Zscaler ThreatLabz found the attack footprint reaches beyond South Korea to organizations globally across many industries, based on a custom ARTEX deployment with AI assistant configurations, synchronization scripts, network routing tools, and a Claude Code prompt history. “ARTEX was configured to use a DeepSeek model through an OpenAI-compatible gateway, but other configurations also specified DeepSeek, GLM, and Grok,” said Seongsu Park.

CrowdStrike said China-linked group VAPOR PANDA used open-source ARTEX to target more than 200 organizations worldwide in less than two weeks. CrowdStrike said VAPOR PANDA started using ARTEX on October 17 to target foreign ministries, U.S. semiconductor, defense, and think tank organizations, and telecommunications providers across regions. CrowdStrike confirmed post-exploitation activity at nine organizations, including backdoor deployment, credential spraying, network scanning, and reconnaissance.

The South Korean attacks were likely carried out by a China-based individual, not a confirmed state-linked group, CrowdStrike said. VAPOR PANDA ran ARTEX mainly on China’s DeepSeek and on a second commercial model CrowdStrike could not identify, with a human operator giving instructions in Mandarin. CrowdStrike said ARTEX planning agents used about 1.4 billion input tokens in a single intrusion.

Google Threat Intelligence Group observed ARTEX execution sequences lasting seconds, including one that produced 27 events in 23 seconds. GTIG said it observed multiple groups, including financially motivated extortion crews, deploy ARTEX in incident response work beginning in late August. “This campaign? It is a warning shot.

It’s unsophisticated skids firing into the sky to see what would happen,” said Rohit Nambiar. GTIG said AI-assisted hacking marks a shift toward machine-speed intrusions with automated chaining of complex attack paths that scale intrusions exponentially.

GitHub user Autumn-27, identified as ARTEX’s developer, removed the original code in October over misuse, according to Google Threat Intelligence Group and Mandiant. Copies still circulate, including localized versions and a commercial edition called ARTEX PRO. The ARTEX creator, who uses the online name Autumn-27, condemned misuse of the tool in an Oct. 8 public statement, denied involvement in the attacks, and said the project would halt public updates and maintenance and become closed-source.

CrowdStrike tied attacks on South Korea’s financial sector in September to a hacker who communicates in Chinese. Censys said one Artex instance in that campaign remained exposed for months and likely contained data on attacks against South Korean banks plus payment and gaming firms.

Many attacks tied to Artex exploited weak or known passwords and the lack of multifactor authentication.

Microsoft urged ConnectWise customers to review Microsoft Entra and Microsoft 365 audit logs for unauthorized changes. It advised keeping connections to affected ConnectWise apps turned off while awaiting official recovery procedures, and checking for unrecognized activity since October 15, including service principal sign-ins dating back to October 1. It also advised restricting external service permissions to the minimum necessary scope.

Mandiant said attackers still rely on stolen credentials and unpatched systems because the underlying techniques remain unchanged. The vendor recommends short-lived credentials, tighter control of exposed administrative interfaces, and monitoring for unusual activity bursts from accounts and applications.