ARTEX: How a Free AI Pentest Framework Became an Attacker Staple

TL;DR

• ARTEX is an open-source, multi-agent AI penetration-testing framework: a Go backend with a Next.js console and a PostgreSQL database, released on GitHub in July 2026. An operator supplies a target and a goal; planner and worker agents run the tools and record assets, findings and evidence in a shared graph.
• Within three months it was used against South Korean banks, in the ConnectWise Cloud Backup supply-chain compromise, in a VAPOR PANDA campaign against more than 200 organizations in 14 countries, and by a Cambodia-based cybercrime cluster Microsoft tracks as Storm-3358.
• The author made the project closed-source on October 8, 2026. Wiz Research counted more than 12,000 forks by then, and independent scans in early November found between roughly 800 and 1,650 exposed consoles, depending on what each scanner counted.
• The framework does not need a software vulnerability to reach cloud access. Unit 42's incident responders watched operators turn password-reset pages and exposed APIs into cloud access in as little as a day.
• Its signature is speed and repetition, not stealth: password sprays at about one attempt per second, 20-60 minute bursts, IP and user-agent rotation, and sessions that run 24-30 hours.
• Hunt for the artifacts: norma/0.4 and artex-enrich/1.0 user agents, source-map downloads followed by calls to internal API routes, alg:none JWTs and OAuth callback probing.
• Close every ARTEX console you own, then treat identity as the perimeter: app consent, service-principal credentials, role assignments and legacy authentication.
• This is a dual-use tool, not a CVE. CISA KEV: not applicable (no CVE; assessed November 13, 2026). Most attempts failed; the danger is the cost of trying again.

Why does ARTEX matter now?

ARTEX matters because it automated the expensive part of penetration testing: chaining ordinary weaknesses at machine speed. Within three months of its July 2026 GitHub release it was used against South Korean banks, in a supply-chain compromise and in a 200-target espionage campaign. Wiz Research reports that a Chinese developer published it, that it won Baidu's "Agent+" red-team challenge that September, and that the project went closed-source on October 8, after attackers had already used it against South Korean banks (Wiz Research, October 22, 2026).

That is a short runway for a security tool. By November, Microsoft had published two reports on actors using it, CrowdStrike had published two more, Seoul police had described a criminal case built on it, and independent scanners were counting exposed consoles by the thousand. The tool did not create a new class of vulnerability. It changed how quickly ordinary weaknesses can be tried, retried and chained.

The important shift is economic. A human pentester is limited by hours, attention and skill. An agent fleet is limited by tokens, proxies and targets. Microsoft's assessment of one campaign found several cases where the time from initial targeting to privileged cloud access was under three hours (Microsoft, October 21, 2026). Unit 42 describes operators turning public password-reset pages and exposed APIs into cloud access "sometimes in less than a day" without exploiting a single software vulnerability (Unit 42, November 11, 2026).

What is ARTEX?

ARTEX is an orchestration system for agents, tools and evidence, not a scanner with an LLM bolted on. A public fork of the project publishes a README that describes a Go monolith that embeds a Next.js frontend, a PostgreSQL database, and an agent runtime built on the author's norma SDK (ARTEX README, a public fork of the upstream project). Four roles share the work: a Goals agent decomposes the target and extracts scope, a Planner produces the next intent, Worker agents execute tools, and a MainAgent keeps a human in the loop.

Two graphs hold the state. The asset graph is global and shared across tasks: root domains, subdomains, IPs, services, apps and endpoints, grouped by company. The exploration graph is per task: goals, intents, facts, findings and hints, linked by edges such as spawns, derived_from, yields and proves. The agents query both graphs as tools, so a fact discovered by one worker becomes context for the next plan.

The framework ships with what an operator needs to run a campaign from a browser: a task dashboard, an asset coverage map, a traffic-recording MITM proxy with its own CA, a tool-approval and intercept screen, MCP server support, reusable "skills", agent memory, and a one-click installer that starts a Docker container on port 8787 (README). The default image includes ripgrep, curl, vim, npm and nmap. Microsoft adds that agents use wget, Python HTTP clients and headless Chromium through Playwright by default (Microsoft); Wiz observed Impacket; Zscaler observed sqlmap and jadx in an operator's customized build (Zscaler ThreatLabz).

That packaging is the point. A tool that used to require a team, a methodology and a report template now starts with docker compose up -d and an API key. The same properties that make it useful to an authorized tester make it useful to someone who is not authorized at all.

A short history of a tool that outran its author

ARTEX was public for less than three months before its author withdrew it. The sequence matters because each step widened the population that could run it.

• July 2026: the project is published on GitHub as an open-source, AGPL-3.0 licensed framework (Wiz; Security Affairs).
• September 2026: Wiz reports that it won Baidu's "Agent+" red-team challenge. In late September, South Korean financial institutions begin reporting intrusions; CrowdStrike later ties an ARTEX console to the campaign.
• October 8, 2026: at 10:50 UTC the author posts a notice that the tool has been abused, that it will go closed-source, and that no further versions will be released. The project goes private (BadByte, November 4, 2026).
• October 11, 2026: Genians reports that the GitHub repository and Docker image have been removed. Forks and mirrors remain (Security Affairs).
• November 2026: about 34 Docker Hub namespaces publish images named artex, with roughly 60,000 combined pulls. AntiFox, a fork of ARTEX 0.1.1, is used in AWS credential-theft intrusions and is still on GitHub at version 2.0 (BadByte; BleepingComputer, November 11, 2026).

Closing the source removed the maintainer, not the capability. Wiz counted more than 12,000 forks by the time the project went private. The Docker ecosystem filled the gap: BadByte found 34 namespaces publishing ARTEX images, and the most-starred copycat repository was not a clean continuation but a trojanized one. A backdoored image, tomicdd/artex, added an unauthenticated login handler that ran shell commands as root and returned the output; Docker removed it on November 5, but 637 GitHub repositories still pointed at it that day. We covered that incident separately in Malicious ARTEX Docker Image Hands Out Root Shells.

The irony is useful for defenders. People who install an offensive tool from an unverified image inherit the same risks they intend to exploit: an unpatched console, a root container, plaintext secrets and a public port. The ARTEX ecosystem is now both an attack platform and a supply-chain target.

What do the attacks look like?

The campaigns differ in motive and tradecraft, but they share a pattern: find an internet-facing application, use identity flows rather than memory corruption, and let the agent iterate until something opens. The table is not a complete list; it is what public reporting establishes.

South Korea: one operator, three named models and a console left open

CrowdStrike's October 7 report describes a campaign against South Korean banks that began in late September. The actor left an ARTEX console and open directories containing Claude Code session histories, ARTEX configuration files and Claude memory files. The ARTEX instance used DeepSeek v4.1 Flash as its primary model, supplemented by GLM-5.3 and Grok 4.6 for Claude Code sessions, and reached DeepSeek through the reseller domain xcai[.]pro (CrowdStrike).

The operator's own files supplied the attribution. A résumé prompt contained a name, phone number, Telegram handle, age, university and location; CrowdStrike cautions that the details cannot be definitively tied to the actor, and that one date of birth in the prompt contradicted another. The sessions also showed the operator asking Claude where Korean breach data is sold and which Telegram groups to approach. BleepingComputer reports that the banks included Shinhan, KB Kookmin and Hana, that personal data and card information were exposed, and that some systems suffered outages (BleepingComputer, October 10, 2026).

Hunt.io's follow-up adds the infrastructure detail. The console at 38.244.50[.]120 sat on Cogent's network in Los Angeles with 15 open ports; the ARTEX login page appeared on 443 and 8090 alongside a Gemini2API admin console and a Tinyproxy server. A Hong Kong jump server held 105 MB of tooling, including scripts that kept reverse SSH tunnels alive, a FOFA query script, a rotating proxy list, and 19 custom skills with 147 recorded uses covering code audit, web injection, WAF bypass, authentication testing, Telegram Mini Apps, APK decompilation and payment logic (Security Affairs).

Storm-0940: from a scan to a supply-chain compromise

Microsoft assesses that Storm-0940, a China-state-aligned actor active since 2021, used ARTEX from as early as September 2026 against hundreds of organizations across aerospace, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology and think tanks. Several intrusions reached privileged cloud access in under three hours (Microsoft).

The supply-chain link is the part to study. Microsoft assesses that Storm-0940 was responsible for the ConnectWise Cloud Backup compromise of a multi-tenant application. After acquiring the identities of multiple ConnectWise cloud applications, agents authenticated to customer environments using the stolen app credentials, then moved into Microsoft Graph: reconnaissance, application credential changes for persistence, changes to identities, groups and privileged roles, and bulk secret reads from Azure Key Vaults.

The parallel password spray shows the tempo. Between October 10 and 14, infrastructure at 144.172.64[.]99 targeted 327 accounts across eight organizations. Microsoft recorded more than 151,000 failed logon events, peaking at 2,900 failures per minute on October 11, with more than 111,000 failures in a single day. Forty-eight accounts received more than 1,000 failures, and lockouts were nearly 98% of the activity. No successful authentication, token issuance, Graph call or directory change was observed in that spray. The supply-chain access came from the stolen application credentials, not from guessing a password.

That distinction matters for defenders. A password spray is noisy and often fails. A trusted multi-tenant application signing in with a valid credential is quiet, because it is supposed to be there. The agent's advantage is that it can do both at once.

VAPOR PANDA: 200 targets in 11 days

CrowdStrike's October 29 report describes a separate China-nexus actor, VAPOR PANDA, using ARTEX from October 17 against more than 200 organizations in at least 14 countries over an 11-day window. The targets included foreign ministries in Latin America, Europe, Asia and the Middle East; semiconductor, defense and think-tank organizations in the United States; and telecommunications providers in several regions. CrowdStrike confirmed post-exploitation at nine organizations and credential spraying against at least 12 more (CrowdStrike).

The technical detail is unusually concrete. At one US pharmaceutical company, the agent chained an unsigned SAML assertion and an XML external entity flaw to query the cloud Instance Metadata Service, obtained a role that could issue administration commands to thousands of instances, and escalated to an enterprise administrator account. At a second, it deployed web shells, abused an unauthenticated orchestration service for root in a production container, read LAPS passwords and abused resource-based constrained delegation. Against a Greek government entity, the operator supplied a 2022 directory export; the agent used the unrotated keys to forge an administrator token, then used VPN configurations found in a user's sent mail to reach the internal network.

VAPOR PANDA also directed the agents to evade endpoint defenses. At a global pharmaceutical company the instruction was to find Windows machines in the domain without Falcon, judged from tasklist and folder listings, using the PRC red-team slang "猎鹰" for the CrowdStrike sensor. In one intrusion, planning agents consumed on the order of 1.4 billion input tokens. That is a useful scale marker: this is not a chatbot session, it is a compute budget.

Cybercrime: the ex-pentester and Storm-3358

The same tool now spans state espionage and ordinary fraud. On October 26, BleepingComputer reported that Seoul police had identified seven suspects in an operation that breached more than 90 organizations in South Korea. The leader was a 32-year-old self-taught hacker who had worked at a cybersecurity company between 2019 and 2022; he began attacking in September 2025 and adopted AI tooling in late August 2026. In 38 incidents the group demanded 360 million won (about $270,000) to withhold stolen data. Police described it as the first Korean arrest in a large-scale hacking and personal-information theft case that exploited generative AI (BleepingComputer).

Microsoft's November 6 report adds the criminal-professional layer. Storm-3358 is a Cambodia-based intrusion cluster that primarily targets financial organizations in Southeast Asia, plus a smaller number of large financial organizations globally. In October 2026 it used ARTEX alongside conventional automation to scan internet-connected systems, exploit anonymous file upload and SSRF, and install the WISP, vshell and AdaptixC2 remote access trojans, with agents using netcat and curl to download them (Microsoft).

The long tail: WorkOS and AntiFox

Not every incident needs a nation-state. WorkOS disclosed on October 30 that an attacker accessed an internal sales application and took business contact details, customer account histories and summaries of sales and support conversations. The company's founder attributed the intrusion to ARTEX and said investigators saw the user agents artex-enrich/1.0 and norma/0.4 in web requests (BleepingComputer, November 3, 2026).

AntiFox shows where forks go next. Arctic Wolf observed Alibaba Cloud hosts running AntiFox interfaces and using valid AWS identities, including IAM users and assumed EC2 roles, to make authenticated API calls. In one case the operator deployed an ASPX web shell on an internet-facing IIS server, read application settings and database connection strings, and copied configuration and log files to a web-accessible directory. In another, they cycled through identities and made hundreds of AWS API requests in about 30 minutes; most were blocked, but some obtained production secrets, and a separate incident used a valid identity to read, copy and delete S3 objects (BleepingComputer).

What do the agents actually do?

Wiz's log analysis is the clearest public description of the loop. Across multiple victims, the agent's first move was to read the application: download JavaScript source maps, config.json, env.js and the OpenAPI document, then call internal API routes whose names appear only in those files (Wiz). That sequence is a fingerprint. A browser loads a bundle; it does not fetch main-3a9f.js.map and then guess GeneratePasswordResetToken two minutes later.

The playbook repeats:

1. Map the application. Source maps, runtime configuration and Swagger/OpenAPI documents reveal routes, parameters and hidden functionality.
2. Probe authentication. The agent initiates sign-in flows, mutates OAuth callbacks and state parameters, submits unsigned JWTs and varies SSO paths. Wiz recorded more than 60 variations of SSO routes with an alg:none token in two minutes.
3. Abuse account recovery. It checks whether a username exists, then calls password-reset, username-recovery and activation endpoints. A 204 from a reset-token endpoint is a useful signal even when no mail arrives.
4. Register and test tenant isolation. Where sign-up is open, it uses a disposable mailbox, confirms the account and immediately requests another company's data by manipulating predictable identifiers.
5. Establish a baseline. Before fuzzing, it requests a nonexistent path such as /zzz-nonexistent-xyz123 to learn what a real 404 looks like.
6. Spray and adapt. Password sprays run at a median gap of one second, in 20-60 minute bursts, with a different user agent per burst and a focus on software engineers. When an IP is blocked, a new one appears within minutes; when an endpoint is rate-limited, the agent switches to another endpoint on the same host.

The table maps those behaviors to what a defender can actually collect.

Two more behaviors are easy to miss. The agent uses ordinary programmatic clients (python-urllib/3.12, python-requests/2.31.0, curl/7.88.1, norma/0.4, artex-enrich/1.0) and trivially spoofed Chrome strings. User agents alone are noisy. The sequence is the signal: a source-map fetch, an internal route, an alg:none token, a reset call and a spray, all from the same ASN within an hour, is not a browser.

Why does it work?

Four properties explain the adoption.

It does not need a vulnerability to reach the cloud. Unit 42's responders describe password-reset pages and exposed APIs as the path to cloud access, with no software vulnerability exploited. Identity flows are designed to be reachable from the internet; that is what makes them useful and what makes them targetable.

The marginal cost is low. Check Point Research analyzed an operator who ran two ARTEX consoles for about two weeks against ten gray-market iOS code-signing shops, using DeepSeek v4.1 Flash and Kimi K3.1 Pro. The operator worked through 36 billion tokens; at official DeepSeek API prices, Check Point estimates the compute cost at $700-$1,500 (Check Point Research, November 5, 2026). The stolen .p12 certificates and plaintext passwords are the inventory of the gray-market signing shops the operator was robbing. The tool is free; the models are commodities; the target list is public.

Guardrails are part of the routing decision. Check Point found Chinese models dominating operator configurations, with DeepSeek Flash the most prevalent. On the three instances where American models were configured, the only refusals observed came from Anthropic's Opus 5.5, and the operator switched to more permissive Chinese models. Model choice is not an ideological statement; it is an operational parameter, and the agent will route around a refusal the same way it routes around a blocked IP.

Identity is the control plane. Each campaign described in this article depended on credentials, tokens or roles at some stage: an OAuth application, a SAML assertion, an IMDS role, a LAPS password, a VPN configuration, a Key Vault secret, an IAM user. The agent does not need to break cryptography. It needs one valid trust relationship and enough attempts to find it.

The exposed-console population is the other half of the story. Independent scans in early November disagree because they count different things: Censys counted more than 800 deployments reachable without a login (TechCrunch, November 6, 2026); Check Point counted 2,557 systems that hosted or had hosted a panel, with 1,608 live and public at the time of its research; BadByte counted 1,645 hosts serving the ARTEX console on November 4; Hunt.io counted about 1,300 hosts by matching the console page title, as reported by Security Affairs. A console that is exposed is not just a victim. It holds target lists, credentials, captured traffic and a proxy CA key, and it is a ready-made jump host.

What should we fear over the next year?

The most likely trajectory is not a single catastrophic ARTEX campaign. It is commoditization.

• More frameworks, not one. Unit 42 counted 1,323 internet-facing hosts running CyberStrikeAI and 609 running ARTEX in October 2026, with 21 hosts running both, and analyzed 14 tools across the ecosystem (Unit 42). Check Point names CyberStrike, Cairn and PentAGI alongside ARTEX. Closing one project does not close the category.
• Cheap forks with new targets. AntiFox took ARTEX 0.1.1 and aimed it at AWS identities. The next fork will aim at whatever its author knows: Kubernetes, SaaS admin APIs, CI/CD, telecom OSS. The framework is a shell; the skills and prompts are the payload.
• Supply-chain access as the multiplier. ConnectWise is the template. A compromised vendor or a stolen multi-tenant app credential gives an agent a trusted path into every downstream tenant at once. Most organizations cannot see that path because it looks like the vendor.
• State and criminal actors on the same tool. Storm-0940, VAPOR PANDA, Storm-3358 and an ex-pentester's group used the same framework with different goals. That convergence compresses the time between a technique appearing in espionage and its use in fraud.
• The defender's alert window shrinks. Microsoft notes that automation generates more traffic and more alerts, but the speed leaves little time to respond before the actor has persistence. An agent that reaches privileged access in three hours will outrun a triage queue measured in days.
• Exposed consoles remain a supply of attack infrastructure. A console with no authentication is a staging point, a credential store and a source of other people's target data. The population is large enough that scanning for it is itself a business.

The counterweight is that current agents are noisy and often fail. Microsoft says the majority of Storm-0940's targeting was unsuccessful. Unit 42 found Cairn generating hundreds of thousands of high-frequency requests from a single origin. Speed creates detection opportunities even as it creates pressure.

How should defenders prepare?

The order matters. Start with the consoles, then identity, then the raw material the agents consume.

1. Find and close ARTEX and lookalike consoles. Search your asset inventory and egress logs for the console title, the default port 8787 and the build IDs. If a console is exposed, treat it as compromised: it holds target lists, credentials, captured traffic and a proxy CA private key. Remove public access, put administration behind a VPN or allowlist, rotate the PostgreSQL password, LLM keys, search API keys, notification webhooks and proxy credentials, and replace jwt.key, which can forge admin tokens.

2. Treat identity as the perimeter. Enforce phishing-resistant MFA, block legacy authentication, and review Conditional Access. Audit app registrations and enterprise applications: who consented, which permissions were granted, which credentials were added, and which service principals self-assigned a role. Microsoft's ConnectWise guidance is precise: preserve configuration and evidence before deleting an application, inventory the affected app IDs, and review service-principal sign-ins from at least October 15, extending to October 1 where records allow.

3. Hunt the agentic sequence, not the user agent. Build detections for a source-map or config.json fetch followed by calls to internal routes; alg:none JWTs and malformed OAuth state; username enumeration followed by reset calls; disposable-email sign-ups followed by object-ID probing; a 404 baseline probe before a fuzzing burst; and failed sign-ins at roughly one per second across many accounts. Keep the per-IP and per-account rates, the ASN, the timing and the path together.

4. Remove the raw material. Do not serve source maps, env.js, config.json or Swagger documents from production unless you intend to. Remove secrets from client bundles and repositories; rotate anything that was ever committed. Require IMDSv2, keep long-term access keys out of application configuration, and scope instance roles to the minimum. These are the same fixes that defeated the manual version of these attacks; they still work.

5. Detect the post-exploitation. Watch for application credential additions, new service principals or owners, app-role assignments, self-assignment of Global Administrator, and bulk SecretGet calls across multiple Key Vaults in a short window. Watch for web shells, netcat/curl downloads to web roots, new cron jobs, LDAP/JNDI traffic, DNS callbacks, and unusual mail or file access. CrowdStrike's hunt markers for one campaign included command lines containing artx, cloud roles prefixed artx-, administration-command comments containing art18-, and the directory C:\ProgramData\artx5v\.

6. Slow the agent down. Microsoft's testing found that honeypots, decoys, tarpits and fake wins reduced attack traffic reaching real assets and produced high-confidence attribution signal. A tarpit consumes the agent's time and budget; a fake win can make it stop on a false success. This is not a substitute for patching, but it changes the economics of an unattended campaign.

7. Rehearse the response. Decide in advance who can disable a vendor application, revoke sessions and rotate keys, and in what order. Preserve logs before containment. Assume that data reachable by the compromised identity was read, and notify on that basis rather than waiting for exfiltration proof.

What does this not mean?

• Not every exposed console is malicious. Many belong to authorized testers who left a lab on the internet. Censys's Silas Cutler makes this point explicitly. The problem is the exposure, not the intent of every operator.
• Most attempts fail. Microsoft observed no successful authentication in the 151,000-event spray, and says the majority of Storm-0940's targeting was unsuccessful. Agents are persistent, not omnipotent.
• A tool is not a campaign. ARTEX has been used by a state actor, a separate espionage group, a criminal cluster and an individual ex-pentester. Attribution belongs to the operator, not the framework.
• The techniques are not new. Wiz notes that none of the individual techniques it observed were novel. What is new is the chaining, the rate and the stamina.
• The counts are not comparable. Censys, Check Point, BadByte and Hunt.io measured different populations on different days. Do not average them or treat one as the true total.

What could not be verified?

• The exact original star and fork counts. Wiz reports more than 12,000 forks at closure; GitHub's repository page is gone, and an archived snapshot could not be retrieved during this research.
• The Baidu "Agent+" win is reported by Wiz Research; we did not find a Baidu or ARTEX primary announcement.
• The number of records stolen in the Seoul police case. BleepingComputer's body says 8.2 million; its headline says 82 million. We use neither figure in this article.
• Whether Storm-3358 and Storm-0940 overlap, or whether the Korean bank actor is connected to either. Microsoft and CrowdStrike describe separate clusters.
• The exact population of exposed consoles. The published counts range from more than 800 to 1,645, and each uses a different definition.
• AntiFox's lineage beyond the reported fork of ARTEX 0.1.1, and who operates the Alibaba Cloud infrastructure.
• Whether the closed-source release reduced misuse. Forks, mirrors and Docker images were already public.

Timeline

• July 2026: ARTEX published on GitHub as an open-source framework.
• September 2026: Wiz reports it won Baidu's "Agent+" red-team challenge; South Korean financial institutions begin reporting intrusions.
• October 7, 2026: CrowdStrike publishes its analysis of the Korean campaign.
• October 8, 2026: the author announces the project will go closed-source; the project goes private.
• October 16, 2026: ConnectWise publishes its initial Cloud Backup advisory.
• October 17-28, 2026: VAPOR PANDA uses ARTEX against more than 200 organizations in 14 countries.
• October 26, 2026: Seoul police announce seven suspects and 90+ breached organizations.
• November 4, 2026: BadByte publishes the backdoored Docker image analysis; 1,645 ARTEX consoles are counted online.
• November 6, 2026: Microsoft reports Storm-3358, a financially motivated cluster, using ARTEX against financial organizations.
• November 11, 2026: Arctic Wolf and BleepingComputer describe AntiFox, a fork, used in AWS credential theft.

FAQ

Is ARTEX a vulnerability or a CVE?

Neither. It is a dual-use penetration-testing framework. A keyword search of the NVD for artex returned no records on 2026-11-13 (NVD), and the intrusions described here exploited known classes of weakness: exposed APIs, weak or absent MFA, password-reset flows, SSRF, unsigned SAML assertions, alg:none JWTs, IDOR and leaked credentials.

Does ARTEX attack mobile apps?

The public reporting describes web applications, identity providers, cloud APIs and on-premises Windows and Linux hosts. Hunt.io recovered iOS probe source code, Android kernel and firmware utilities and a cryptocurrency exchange tool in one operator's directory, but their connection to the confirmed breaches is not established. Mobile estates are more likely to be reached through the backend APIs and identity flows the same agents target.

Can I detect it with user-agent blocking?

Not reliably. Operators rotate user agents, and Wiz recorded 15 different strings across victims, including ordinary Chrome strings and python-urllib. Use user agents as one weak signal, and correlate them with request sequence, rate and path.

Is running ARTEX for authorized testing safe?

Only if you treat it as a high-risk service. The console has no authentication beyond its login form (BadByte), the container runs as root, the compose file publishes port 8787 on all interfaces, and secrets are stored in plaintext. Put it behind a VPN, restrict egress, use a dedicated host, rotate its keys, and never install it from an unverified image.

What is the single most useful control?

Closing internet-exposed administrative and identity surfaces. Unit 42's point is that these agents cannot target what they cannot find. Every console you remove, every source map you stop serving and every reset flow you rate-limit reduces the set of paths an agent can try at machine speed. If you only do one thing, start with the console-hunting checklist in "How should defenders prepare?"; the trojanized image is covered in the separate ARTEX backdoor write-up.

References

• Microsoft Threat Intelligence, "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise", October 21, 2026: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ (checked 2026-11-13)
• Microsoft Threat Intelligence, "ARTEX abuse expands as cybercriminals target financial sector", November 6, 2026: https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/ (checked 2026-11-13)
• Wiz Research, "ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors", October 22, 2026: https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors (checked 2026-11-13)
• CrowdStrike, "Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", October 7, 2026: https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/ (checked 2026-11-13)
• CrowdStrike, "VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign", October 29, 2026: https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/ (checked 2026-11-13)
• Check Point Research, "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns", November 5, 2026: https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/ (checked 2026-11-13)
• Unit 42, "ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know", November 11, 2026: https://unit42.paloaltonetworks.com/artex-and-ai-powered-red-teaming-tools/ (checked 2026-11-13)
• Zscaler ThreatLabz, "Inside the Global AI-Assisted Hacking Campaign": https://www.zscaler.com/blogs/security-research/inside-global-ai-assisted-hacking-campaign (checked 2026-11-13)
• Security Affairs, "Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches", November 7, 2026: https://securityaffairs.com/184100/cyber-crime/inside-artex-ai-hacking-tools-exposed-servers-and-south-korean-bank-breaches.html (checked 2026-11-13)
• BleepingComputer, "Hacker used ARTEX AI and Claude agents to target South Korean banks", October 10, 2026: https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/ (checked 2026-11-13)
• BleepingComputer, "Former pentester used ARTEX AI to steal 8.2 million data records", October 26, 2026: https://www.bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records/ (checked 2026-11-13)
• BleepingComputer, "WorkOS says attacker used ARTEX AI to breach internal sales app", November 3, 2026: https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/ (checked 2026-11-13)
• BleepingComputer, "Hackers use AntiFox AI agents in AWS credential-theft attacks", November 11, 2026: https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/ (checked 2026-11-13)
• BadByte, "ARTEX Backdoor: 7,946 Pulls of a Trojanized Docker Image Handing Out Root Shells", November 4, 2026, updated November 5, 2026: https://badbyte.io/artex-backdoor-docker-image/ (checked 2026-11-13)
• TechCrunch, "Hundreds of Artex AI hacking tools found publicly exposed to the web", November 6, 2026: https://techcrunch.com/2026/11/06/hundreds-of-artex-ai-hacking-tools-found-publicly-exposed-to-the-web/ (checked 2026-11-13)
• ARTEX README, public fork of the upstream project: https://github.com/horizonl/ARTEX (checked 2026-11-13)
• NVD keyword search for artex, zero records on 2026-11-13: https://nvd.nist.gov/vuln/search/results?query=artex&search_type=all (checked 2026-11-13)