Cybercriminals and China-aligned threat groups are increasingly using a powerful AI-driven framework called ARTEX to conduct enterprise attacks at unprecedented speed. Instead of manually piecing together reconnaissance, credential theft, and cloud privilege escalation, attackers are leveraging multiple AI agents that observe, test, and make decisions autonomously. Recent campaigns show how ARTEX can move from initial compromise to serious damage in just minutes.
How ARTEX Works
Released on GitHub in July 2026 and written in Go, ARTEX is designed as a multi-agent offensive-security framework. It is built with a Next.js interface, and it uses large language models connected to specialized sub-agents that manage tasks such as reconnaissance, exploitation, and post-compromise operations. An operator starts by defining a target and objectives; ARTEX then splits those objectives into smaller tasks, shares findings across a graph of agents, and adapts based on what each agent discovers. This enables faster movement through an environment compared to traditional manual hacks.
Real-World Shadow Operations
Multiple cyber threat investigations—including from Google Threat Intelligence, Microsoft, CrowdStrike, and Wiz—have tracked ARTEX being used in real attacks across varying industries and organizations. Microsoft linked ARTEX to a group called Storm-0940 that used the framework to exploit ConnectWise applications in Microsoft 365 environments. In one campaign, the framework accessed over 2,250 Microsoft 365 tenants using compromised application credentials, bypassing interactive sign-ins.
Another group, VAPOR PANDA, targeted more than 200 organizations across over 14 countries in a short span. That campaign combined ARTEX with other AI tools to map cloud settings, gather credentials, and move laterally inside victims’ environments. Some operations also involved deploying backdoors and intentionally targeting systems lacking endpoint protection.
What ARTEX Does After Initial Access
ARTEX excels at Active Directory reconnaissance, privilege escalation, and cloud permission discovery once access is established. It can perform automated PowerShell audits, identify weak service accounts, map domain certificates, and even execute Kerberoasting and DCSync attacks. In cloud environments like AWS and Azure, ARTEX rapidly checks what credentials can actually access—not just what they’re supposed to. Leakages like over-privileged service principals or wide-open workload identities are immediately exposed and abused. Legitimate app features have even been turned into weapons—e.g. abusing notification systems to message internal users, or enabling OS-level execution from database privileges.
Signs That Something’s Wrong
Defenders need to watch for bursts of activity that wouldn’t normally happen all at once: thousands of failed authentications, rapid permission tests, or clusters of unusual API calls layered alongside application permission changes. Examine logs from identity providers (Microsoft Entra ID, Okta, Cognito), cloud audit records, Microsoft 365 actions, HTTP and WAF logs, endpoint telemetry, and Windows security events. Also inspect application identities, OAuth service principals, and API credentials—especially if any of them show unexpected sign-ins, elevated permissions, or strange interactions. Detection tools should prioritize behavior over named indicators. ARTEX uses familiar filenames or strings like “artex-probe-” or “artx”, but attackers can rename these at will.
Steps Every Organization Should Take Immediately
- Inventory all service principals, OAuth apps, API credentials, and workload identities. Know who owns them, what permissions they hold, and how they normally behave.
- Preserve and review authentication logs, cloud audits, application changes, endpoint telemetry, and any network or identity-related evidence that could show suspicious sequences.
- Trace the timeline of events when ARTEX-like behavior is suspected—first access, resource access, credential changes, administrative activities, data exfiltration.
- Contain compromised identities by disabling or revoking permissions; rotate affected credentials through secure processes.
- Look for persistence beyond obvious paths—new admin accounts, scheduled tasks, mailbox permissions, application grants.
- After recovery, ensure strong monitoring remains in place and ensure that services are running securely.
ConnectWise has issued a security-hardened restoration plan for its Cloud Backup service and advised customers to follow approved re-authorization procedures. That said, restoring services is only one step—understanding and blocking possible attacker access paths matters just as much.
This is more than a new piece of malware—it’s a shift in how enterprise attacks are launched. Existing security gaps—weak credentials, exposed APIs, overly broad permissions—are being stitched together by AI faster than ever. For defenders, behavior-based detection, strong identity hygiene, and rapid incident response aren’t optional—they might be the only things standing between safe operations and fast-moving compromise.
What this means: ARTEX shows AI is not just augmenting attackers; it’s automating key stages of intrusions. Organizations that still treat traditional alerts in isolation will likely miss orchestration across systems. Watch for emerging detection tools focused on identity graph analysis, cloud permission dynamics, and automation pulse metrics. The next battleground will be speed—and whether defenders can adapt as fast as attackers are automating.
