Loading malware…
ARTEX is a Go-based agentic AI penetration-testing framework developed in China and abused for automated intrusions. Originally open source, it was subsequently made closed source following attacks against South Korean financial institutions. It coordinates a main agent with subordinate planning and worker agents through a shared graph of facts, findings, and objectives. Integrated language models support parallel attack paths, adaptation after failed attempts, and human-directed intervention.
Observed malicious use includes internet-facing application exploitation, scanning, reconnaissance, password spraying, credential theft, privilege escalation, lateral movement, web-shell deployment, and data exfiltration. ARTEX-assisted operations have abused application and identity weaknesses, cloud metadata services, and compromised OAuth application identities. Attackers have modified application credentials and privileged identities to retain access to Microsoft 365 environments. Other operations used agents to recover administrative credentials, access mailboxes, and identify Windows hosts lacking endpoint protection.
ARTEX has been used by the China-nexus actors VAPOR PANDA and Storm-0940 in separate campaigns, as well as by financially motivated operators. VAPOR PANDA paired it primarily with DeepSeek to target more than 200 organizations across at least 14 countries beginning in October 2026. Targets included government ministries, telecommunications providers, and pharmaceutical, semiconductor, defense, nuclear, and financial organizations. Storm-0940 used ARTEX for reconnaissance, password spraying, and OAuth application abuse in the ConnectWise Cloud Backup supply-chain compromise and downstream customer environments. Separate attacks against South Korean financial institutions involved exploitation of internet-facing applications and theft of personal information. ARTEX is a dual-use intrusion framework rather than a conventional standalone malware payload.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
CrowdStrike identified a VAPOR PANDA campaign using ARTEX, along with DeepSeek and another commercial LLM, to attack multiple high-value targets.
Beginning on October 17, 2026, the adversary used ARTEX against more than 200 distinct organizations worldwide.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
« Dès septembre 2026, Storm-0940 a utilisé ARTEX pour […] Accélérer la reconnaissance et le scanning »
“Identified a two-server structure consisting of a primary control node and an ARTEX hosting node.”
VAPOR PANDA used ARTEX to run multiple engagements simultaneously, intervening only to steer the agents at decision points.
Used stolen VPN configurations and leaked credentials
« Utiliser les credentials volés des applications ConnectWise pour s’authentifier dans les environnements clients »
The agent ... used VPN configurations recovered from a user's sent mail, alongside a VPN client key ... to reach the internal network.
The agent chained an unsigned Security Assertion Markup Language (SAML) assertion and an XML external entity (XXE) flaw to query the cloud Instance Metadata Service.
Compromising a multi-tenant OAuth application to access downstream customer environments.
Issued commands to instances via a cloud systems manager
Used stolen VPN configurations and leaked credentials
« Utiliser les credentials volés des applications ConnectWise pour s’authentifier dans les environnements clients »
« Effectuer des opérations via Microsoft Graph (reconnaissance, modification de credentials, escalade de privilèges) »
« opérations Microsoft Graph incluant modification de credentials d’applications, changements de rôles privilégiés et persistance »
The agent ... used VPN configurations recovered from a user's sent mail, alongside a VPN client key ... to reach the internal network.
Deployed JSP and PHP web shells
Used stolen VPN configurations and leaked credentials
« Utiliser les credentials volés des applications ConnectWise pour s’authentifier dans les environnements clients »
« Effectuer des opérations via Microsoft Graph (reconnaissance, modification de credentials, escalade de privilèges) »
« opérations Microsoft Graph incluant modification de credentials d’applications, changements de rôles privilégiés et persistance »
Abused resource-based constrained delegation to impersonate a privileged account.
Used stolen VPN configurations and leaked credentials
« Utiliser les credentials volés des applications ConnectWise pour s’authentifier dans les environnements clients »
Abused resource-based constrained delegation to impersonate a privileged account.
« une campagne de password spraying entre le 10 et le 14 octobre ciblant 327 comptes dans 8 organisations (151 000+ échecs de connexion, pic à 2 900 échecs/minute) »
Queried the metadata service via XXE to obtain cloud role credentials
Read Local Administrator Password Solution (LAPS) passwords
The agent used those keys to forge an administrator token and read mailboxes.
Submitted unsigned SAML assertions
Identifying privileged cloud accounts for further targeting.
Find Windows machines in the domain without Falcon, judging by tasklist and folder listings
Mapping cloud infrastructure for further targeting.
Read mailboxes on a compromised mail server
“Accessed targets through multiple proxy exits to hide the true source and maintain operational continuity.”
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.