ARTEX: Inside an Agentic Attack Framework

AI is changing how attackers carry out cyberattacks, allowing them to automate entire attack chains that previously required significant manual effort. On November 13, the FBI issued a FLASH alert warning that threat actors are using ARTEX, a Chinese open-source pentesting platform publicly released on GitHub in July 2026, to automate intrusions “at machine speed, from reconnaissance through data exfiltration.” ARTEX uses LLMs to translate high-level objectives into commands and adapts its approach based on the results with minimal human intervention. The tool was originally developed for authorized pentesting, and its developer removed the repository on October 8th after threat actors adopted it.

Unfortunately, removing the repository did little to stop its proliferation. Multiple forks and copies remain publicly available on GitHub, including translations and rebrands. On November 5, Censys reported 1,465 hosts running publicly exposed ARTEX consoles, while Check Point Research independently identified 1,608 active instances. Not all of these instances are necessarily malicious, but the sheer volume of active hosts highlight how widespread ARTEX remains despite the removal of the original repository.

Threat actors have leveraged ARTEX and similar agentic attack frameworks to chain together and execute various attack methods. While the techniques are not new, ARTEX increases the speed and efficiency at which attacks are executed. This reduces the time defenders have to detect and respond to an intrusion. Understanding the agentic pentesting framework's workflow can help defenders identify these threats as they occur.

ARTEX In the Wild

Google Threat Intelligence Group (GTIG) observed threat actors using ARTEX as early as August 2026. The framework gained greater attention late September when 16 South Korean financial firms were breached. According to CrowdStrike, the campaign was likely carried out by a Chinese-speaking, financially motivated actor. This threat actor leveraged ARTEX, with DeepSeek as its primary LLM, to target internet-facing applications and exfiltrate PII data. Recovered sessions showed the actor searching for online marketplaces and Telegram groups to sell the stolen data. Stolen PII data could be used for targeted phishing, impersonating financial institutions, loan fraud, and identity theft. The campaign was an early, powerful, demonstration of how ARTEX could help an attacker conduct multiple intrusions within days.

Storm-0940 expanded ARTEX’s use beyond attacks against internet-facing applications. Microsoft observed the China-aligned threat actor using ARTEX as early as September 2026 to automate attacks against hundreds of organizations worldwide. By mid-October, the actor had turned its attention to compromised ConnectWise Cloud Backup application credentials. With these credentials, Storm-0940 used ARTEX to automate authentication attempts against more than 2,250 Microsoft 365 tenants. This exploited the existing trust between the applications and Microsoft 365 tenants. In some environments, the attackers used Microsoft Graph to discover cloud resources, modify application credentials, and establish persistence. ConnectWise subsequently suspended its Cloud Backup service while investigating the compromise and restoring affected systems.

Beyond cloud environments, threat actors have also integrated ARTEX into existing intrusion workflows. On November 6, Microsoft reported that Cambodia-based group Storm-3358 has been using ARTEX to target financial institutions since October 2026. The group combined ARTEX with automated tools to scan internet-facing systems and exploit vulnerabilities. Researchers also observed ARTEX agents using utilities such as curl and netcat to download open-source RATs, including WISP, Vshell, and AdaptixC2, onto compromised systems. The actors used these tools to establish persistence and move laterally. These highlighted campaigns demonstrate how ARTEX supports multiple stages of an intrusion, from initial access to exploitation.

Threat Landscape

The growing adoption of ARTEX enables attackers to delegate tasks and decision making with little to no intervention. By providing only an objective and target, this reduces the technical expertise and hands-on effort required to execute complex attack chains. This also allows threat actors to accelerate and scale their operations. Microsoft observed this attack chain acceleration during Storm-0940's ARTEX-driven campaign. In multiple ARTEX-assisted attacks, the actor progressed from initial targeting to privileged access in less than three hours. This reduces the available time defenders have to detect and respond before attackers gain privileged access.

While ARTEX has attracted considerable attention, it is far from the only framework offering these capabilities. According to GitGuardian, approximately 45 other open-source agentic attack frameworks exist. Additionally, servers may co-host multiple agentic attack frameworks. Censys found that approximately 10% of the internet-exposed ARTEX hosts retained other tooling, such as scripts, exploit kits, malware, and C2 frameworks.

ExtraHop’s Reveal Labs observed similar patterns when investigating exposed directories operating as ARTEX hosts. Of the 3,447 ARTEX hosts identified, 9.5% contained files associated with at least one other agentic AI framework, with CyberStrike AI appearing most frequently. This analysis excludes ARTEX derivatives and non-agentic tools. As a result, the findings may underestimate the presence of additional offensive tooling. These findings show that multiple agentic frameworks can appear on the same infrastructure. Their operational use, purpose, and any coordination between them remain unverified, but this highlights the growing ecosystem of autonomous frameworks.

ARTEX Architecture

To better understand how ARTEX operates, the Reveal Labs team simulated its activity in a controlled lab environment using ScopeWeaver and ScopeSentry. ScopeWeaver is an English-localization, rebranded fork of ARTEX that retains the underlying multi-agent architecture. ScopeSentry, developed by the same author as ARTEX, is a reconnaissance tool that discovers assets, performs enumeration, and scans for vulnerabilities. It identifies domains, subdomains, IP addresses, open ports, and web endpoints. These findings can be imported into ScopeWeaver to provide its agents information about the target environment. Although ScopeSentry is an optional integration, the two tools can work together to support reconnaissance and subsequent pentesting. For this analysis, we primarily focus on ScopeWeaver and its autonomous attack capabilities.

ScopeWeaver allows operators to configure locally hosted LLMs or connect to cloud-based models through APIs, with support for multiple models as fallback. To begin an operation, the operator creates a task that defines the target and objective. A planner agent then breaks the objective into smaller steps, known as intents, and assigns them to worker agents. Multiple workers can run concurrently, using existing security tools and commands to carry out their assigned actions. Operators can customize agent instructions, model selection, and available tools to tailor the framework’s approach towards each objective.

Figure 1: Diagram of ARTEX internal workflow

As workers complete their tasks, they record their observations and findings into a PostgreSQL database. The framework uses these to guide its next steps, creating a continuous cycle of planning, execution, and analysis. This allows ScopeWeaver to adapt its approach with limited human interaction. Its customizable agents, reusable templates, and tool integrations also make it adaptable to different attack scenarios. By studying these workflows in a controlled lab, Reveal Labs can identify attacker behaviors and explore how defenders can detect and investigate them.

Attack Walkthrough

Reveal Labs simulated various parts of the attack chain using ScopeWeaver to understand its capabilities and determine what ExtraHop’s RevealX could detect.

We tasked ScopeWeaver with accessing a Windows host (10.0.4.6) and opening a shell on the domain controller (10.0.3.4) using the domainadmin account. We provided both valid and invalid credentials to streamline the simulation and focus on execution techniques.

Remote access attempts with SSH and RDP

ScopeWeaver initially attempted to access the Windows host using SSH, but the connection failed. It then tried several alternative methods, including RDP through Remmina, sshpass, and CrackMapExec, all of which were unsuccessful.

RevealX captured both the RDP and SSH brute force attempts.

Figure 2: ScopeWeaver attempting to gain remote access to Windows host

Network scanning

ScopeWeaver then used Nmap to scan the target for open ports. The scan identified ports 5985 and 5986, commonly associated with Windows Remote Management (WinRM).

This activity triggered three RevealX detections: TCP SYN Scan Activity, Suspicious User Agent String from a Scanner, and New Dual-Use Software Activity.

Figure 3: ScopeWeaver successfully performing a port scan using Nmap

Figure 4: One of the detections that triggered due to Nmap’s port scan

Pivoting to WinRM

After identifying the open WinRM ports, ScopeWeaver shifted its approach to explore additional remote access methods. Its initial PsExec attempt failed, followed by unsuccessful attempts using xfreerdp and rdesktop. The agent then switched to Evil-WinRM and Test-WSMan. The framework successfully verified WinRM connectivity using Test-WSMan, but could not establish a remote shell. Despite this limitation, ScopeWeaver reported the task as successful, treating the connectivity check as sufficient evidence of access.

RevealX generated five detections associated with the activity: New Dual-Use Software Activity (PsExec), New Remote Service Launch Attempt, New PowerShell Remoting Attempt, Unusual HTTP Plaintext Authentication, and Plaintext Credentials Sent over HTTP.

Figure 5: ScopeWeaver using Evil-WinRM with Test-WSMan to confirm connectivity

Figure 6: One of the detections that triggered during PsExec and WinRM activity

Registry Modification

In a separate simulation, Reveal Labs tasked ScopeWeaver with modifying the NoLockScreen registry value on a Windows host to further evaluate its post-compromise capabilities. ScopeWeaver successfully established a remote shell using Impacket's PsExec and set the NoLockScreen value to 1, disabling the Windows lock screen. Although this modification does not establish persistence, it demonstrates the framework's ability to modify system configurations.

RevealX generated several detections associated with the simulation, including New PowerShell Remoting Attempt, NetExec Activity, and Impacket PsExec Activity.

Figure 7: ScopeWeaver successfully changing registry value for NoLockScreen

Figure 8: RevealX detected Impacket PsExec usage

Across these simulations, ScopeWeaver adapted to failed attempts by trying alternative access methods and used established offensive tools to execute post-compromise actions. RevealX detected several of the underlying behaviors, even when ScopeWeaver failed to achieve its intended objective.

Detecting Agentic Attack Frameworks

ARTEX and similar agentic frameworks generate network traffic that can help defenders identify their activity. When ARTEX runs within a monitored network, its communications may expose recognizable characteristics. During the simulations, Reveal Labs identified several network characteristics associated with ARTEX and its underlying LLM communications. These included suspicious user-agent strings such as scopeweaver, artex-enrich/1.0, and Mozilla/5.0 (spa-api-recon), which RevealX can detect with its Suspicious User Agent detection.

The team also observed JSON payloads containing function names like list_findings, record_fact, and shell_send in LLM API requests. With session key forwarding configured, RevealX can decrypt supported TLS traffic and inspect these payloads when the relevant session keys are available. Additionally, idle ARTEX workers sent periodic keep-alive messages approximately every five seconds while waiting for new tasks. Although these characteristics are not necessarily unique to ARTEX, they provide additional context for investigating potentially unauthorized deployments.

Figure 9: Part of decrypted LLM API call’s JSON payload

More often than not ARTEX and similar attack frameworks are running outside a monitored environment. Internal communications, such as worker coordination and LLM API requests, may never traverse the victim network. This means defenders must rely on indicators of known infrastructure and attack behaviors directed at their systems. ExtraHop’s Request with a Suspicious ARTEX Domain and Outbound Connection to a Suspicious ARTEX IP Address detectors can help detect if hosts are communicating with known ARTEX infrastructure.

While these indicators provide valuable visibility, attackers can easily change their infrastructure. Agentic frameworks also combine existing tools and techniques into automated attack chains, making it difficult to distinguish their activity from that of human operators or other AI-driven frameworks. Therefore, it is important to detect suspicious behavior rather than relying solely on threat feeds or tool-specific indicators. RevealX includes hundreds of built-in behavioral detectors that can identify techniques regardless of the host or tools that execute them. As seen in our research, RevealX detections trigger around behaviors of executed tasks. This highlights the importance of maintaining detection coverage across the MITRE ATT&CK framework, ensuring techniques can be detected even as adversaries adopt new tools.

Keeping Pace with Agentic Attacks

Agentic attack frameworks often prioritize speed over stealth. As agents test commands, troubleshoot errors, and explore different attack paths, they can generate bursts of suspicious activity. GTIG observed ARTEX executing tasks in short bursts of roughly 2 to 25 seconds and in a separate attack, generating 240 log events while attempting to overcome technical challenges. As attackers automate their operations, defenders must keep pace. Agentic SOC workflows can help bridge this gap by accelerating investigations and identifying new detection opportunities.

Since agentic frameworks take a trial-and-error approach, analysts can hunt for clusters of related activity within short time windows. Repeated authentication attempts, rapid changes in technique, and multiple detections involving the same systems may reveal an automated attack sequence. ExtraHop's Model Context Protocol (MCP) server enables analysts to investigate these patterns by providing agents with access to network telemetry, detections, and records. With this information, agents can help reduce the manual effort required to correlate events and identify potential attack sequences.

Example prompts include:

• Did any scanning detections fire within 5 minutes of an exploitation detection within the last 7 days?
• Show servers that had an exploitation detection and, within 10 minutes, made a first-time outbound LDAP, RMI, or HTTP connection to an external IP.
• Are there any devices that produced multiple distinct detection types within the last 24 hours?

Figure 10: Query to ExtraHop’s MCP for correlating events

These capabilities also create opportunities for detection engineering within an agentic SOC. Analysts can provide agents with indicators such as JA4 fingerprints and user-agent strings to create signature-based detections. Similar to prompts used for threat hunting, agents can help identify recurring patterns that could serve as the basis for new behavioral detections. These patterns can also be tested for frequency to understand the potential false positive rate. Moving towards agentic SOC workflows enables defenders to turn network observations into actionable defenses.

Conclusion

ARTEX is just one of many agentic attack frameworks reshaping the threat landscape. By combining existing tools and commands with AI-driven decision-making, these frameworks allow attackers to automate and chain together techniques to achieve their goal. The underlying techniques remain mostly unchanged. ARTEX-driven compromises look like any other intrusion whether it be commodity C2, reverse tunnels, callback servers, or credential theft. This highlights the importance of detecting malicious behavior rather than relying only on tool-specific signatures. ExtraHop RevealX’s network visibility combined with its agentic capabilities can help defenders quickly identify and respond to suspicious behaviors across the attack lifecycle, regardless of which framework, tool, or human executes them.

Resources

• FBI Flash Alert: ARTEX Autonomous Penetration Testing Framework
• Censys: ARTEX: Agentic Asbestos
• Check Point: Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns
• ConnectWise: Latest Advisories
• CrowdStrike: Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
• ExtraHop: ExtraHop Agent Skills
• ExtraHop: ExtraHop MCP Server
• Financial Services Commission: Authorities Hold Meeting on Cybersecurity Management in Financial Sector to Bolster Anti-Hacking Measures
• GitGuardian: Beyond ARTEX: 45 Agentic Attack Frameworks, What They Hunt For, and How to Find Them
• GitHub: ScopeSentry
• GitHub: ScopeWeaver
• Google: ARTEX and Friends: Enter Agentic Offensive Frameworks
• Microsoft: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
• Microsoft: ARTEX abuse expands as cybercriminals target financial sector
• Microsoft: ConnectWise Cloud Backup OAuth App Compromised by Threat Actor LinkedIn Post
• ThreatBook: Analysis of the AI-Driven ARTEX Attacks on South Korean Financial Institutions