Confirmed Intrusions, Confirmed Problem
Google Threat Intelligence Group (GTIG) and Mandiant stated on October 30, 2026 that multiple threat actors are operating open-source agentic pentesting frameworks in real intrusions, naming ARTEX, PentAGI, Hexstrike, and CAIRN [5][15]. RuntimeWire published a curated list of 18 such frameworks that security teams should actively track, starting with the four already appearing in incident reporting and extending to 14 additional tools that carry meaningful dual-use and supply-chain risk [14]. Separately, Kaspersky documented CyberStrikeAI driving a full post-exploitation chain to Active Directory domain admin in three to four days [17][19], and Check Point observed HexStrike AI being discussed on darknet forums for rapid exploitation of Citrix vulnerabilities [20][21].
The complete RuntimeWire inventory: ARTEX, Cairn, CyberStrike, PentAGI, CyberStrikeAI, PentestGPT, PentestAgent, AutoPentester, VulnBot, RedAmon, MAPTA, Strix, Shannon, BugTraceAI, Nebula, hackingBuddyGPT, HexStrike AI, and CAI [14].
ARTEX: Architecture and Proliferation
ARTEX was published on GitHub as Autumn-27/ARTEX on July 26, 2026, under the AGPL-3.0 license [3]. Written in Go with a Next.js web console backed by PostgreSQL, it functions as a multi-agent AI orchestration layer on top of ScopeSentry, an asset-discovery and vulnerability-scanning platform also maintained by Autumn-27 [3][5]. ARTEX accepts a target and an objective, uses a planner agent to decompose work into intents, and dispatches worker agents that execute with tools such as nmap, Impacket, bash, curl, and raw web requests [7]. Results feed two internal graphs: an asset graph (domains, services, endpoints) and an exploration graph (goals, facts, findings) [7]. The system loops until the objective is met or an operator intervenes.
The model layer is replaceable. ARTEX runs on any OpenAI-compatible endpoint: Claude, GPT, DeepSeek, GLM, and Grok [7]. CrowdStrike identified an operator using DeepSeek v4.1-flash as the primary backend, supplemented by GLM-5.3 (Zhipu AI) and Grok 4.6, with exposed infrastructure containing Claude Code session logs and ARTEX configuration files [7][8].
On October 8, 2026, developer Autumn-27 posted that ARTEX was being misused, halted updates, and announced the project would go closed-source [2][3]. Forks persist globally, including ScopeWeaver and a commercial variant dubbed "ARTEX PRO" [2][5].
Vapor Panda
CrowdStrike tracks the China-nexus espionage group Vapor Panda, which used ARTEX against more than 200 organizations across at least 14 countries in an 11-day window beginning October 17, 2026 [4][6]. Targets included foreign ministries in Latin America, Asia, and Europe; an interior ministry in the Middle East; and 19 U.S. organizations spanning pharmaceutical, defense, semiconductor, nuclear, and financial sectors [6]. Telecom firms in the U.S., Philippines, and Belgium were compromised [6]. CrowdStrike confirmed post-exploitation at nine organizations, where operators deployed the BloodAlchemy backdoor via DLL sideloading [6][34]. At one U.S. organization, an ARTEX agent chained weaknesses in SAML authentication and XML processing to obtain cloud credentials with extensive administrative privileges [6]. At another, an agent gained root access through an orchestration service that lacked authentication [6].
Storm-0940 and the ConnectWise Supply Chain
Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China-state-aligned actor active since at least 2021 [9][10]. Beginning in September 2026, Storm-0940 used ARTEX to automate password spraying at 2,900 sign-in attempts per minute, OAuth token theft, and Microsoft Graph reconnaissance across downstream Microsoft 365 tenants [11][12]. The compromised ConnectWise application credentials gave the actor access to more than 2,250 tenants [12]. In multiple environments, privileged cloud access was achieved in under three hours [9]. Follow-on activity included application credential modification, privileged role self-assignment, and persistent backdoor establishment [10]. ConnectWise suspended affected services on October 17 [13].
Google observed ARTEX send output to 491 rotating webhook.site URLs during one intrusion, establishing C2 and execution on an internal Windows database server using native curl to pull dynamically generated PowerShell and batch scripts [5]. ARTEX also wrote and immediately deleted test blobs in 330-400ms bursts and ran 8-second ARM deployment/validate dry-run sweeps across 11 Azure resource types [5].
Crafty Falcon
On November 4, 2026, CERT-In warned Indian financial and cryptocurrency organizations about the "Crafty Falcon" campaign, identifying ARTEX, PentAGI, Cairn, and CyberStrikeAI as publicly available AI-driven offensive tools associated with the activity [1][16]. The advisory updated an earlier October 9 warning about exploitation of payment and disbursement APIs for unauthorized fund transfers [16].
Exposed ARTEX Infrastructure
As of November 4, 2026, Censys observed 1,465 hosts running an exposed ARTEX console on the public internet [1][3]. Roughly 650 sat in two blocks of identically configured hosting, leaving approximately 815 distinct-looking deployments [3]. Of these, 155 (10.6%) also ran at least one other tool Censys detects as a threat, including Vshell, Cobalt Strike, and Adaptix C2 [1][3]. Censys found 32 open directories on ARTEX hosts exposing post-exploitation kits, stagers, and implants [3]. Censys had observed open directories on the specific ARTEX server named in CrowdStrike's report starting August 18, 2026, seven weeks before that report was published [3].
CyberStrikeAI: From SQL Server to Domain Admin
CyberStrikeAI is an open-source, modular platform written in Go, hosted on GitHub as aipentest/cyberstrikeai under the Apache 2.0 license [17]. As of November 2, 2026, the repository showed more than 8,000 stars [17]. Kaspersky's Securelist team documented intrusions against educational organizations across Latin America and Africa between September and October 2026 [18][19]. In one reconstructed case, operators entered through a compromised Microsoft SQL Server, paused for roughly two weeks, then deployed the CyberStrikeAI implant [17][18]. From agent deployment to domain-administrator compromise took three to four days; the final sequence of lateral movement, credential collection, and database export took no more than an hour [19]. Kaspersky reported DCSync and Golden Ticket activity after privileged domain credentials had been compromised [19]. Securelist stated the available data does not let it link the activity to any known attacker group [17].
PentAGI, Hexstrike AI, and CAIRN
PentAGI, built by VXControl, is a fully autonomous multi-agent system using open-source Kali Linux tools (Metasploit, nmap, SQLmap) in Docker sandboxes, with a Neo4j knowledge graph and support for OpenAI, Claude, and DeepSeek backends [23]. GTIG stated that most observed PentAGI activity was scanning, but some led to intrusions and persistence, including a customized build that scanned system integrators and telecom firms across Asia [15]. PentAGI had 33,688 GitHub stars as of November 8, 2026 [26].
HexStrike AI, created by independent researcher Muhammad Osama, integrates with over 150 security tools and supports dozens of specialized AI agents for vulnerability intelligence, exploit development, and attack chain discovery [20][21]. It operates through external LLMs using MCP in an operator-in-the-loop mode [20]. Check Point observed darknet forum discussions about using HexStrike AI to exploit Citrix vulnerabilities CVE-2025-7775, CVE-2025-7776, and CVE-2025-8424 [20][21]. The tool had 13,440 GitHub stars as of November 8, 2026 [26].
CAIRN functions as a general-purpose state-space search engine validated on autonomous penetration testing; given an origin and a goal, it searches for the attack path [23]. GTIG and Mandiant included it alongside ARTEX and PentAGI in confirmed incident response engagements [5][22].
The Second Wave: 14 Frameworks Without Published Incident Reports
The remaining tools on the RuntimeWire list have not appeared in published incident reporting. Their capabilities are not theoretical. Benchmark data from the awesome-ai-pentest repository and independent evaluations provide concrete measurements.
Shannon achieved 96.15% on a hint-free, source-aware XBOW benchmark [27][29]. It combines white-box source code analysis with black-box dynamic exploitation managed by an orchestrator through four phases, licensed under AGPL-3.0 [29]. It held 51,444 GitHub stars as of November 8, 2026 [26].
Strix runs a team of AI agents that probe codebases, live web apps, and APIs from Docker sandboxes, exploiting findings and reporting validated results with proof-of-concept exploits [26]. In comparative testing, Strix was one of only two tools (with CAI) that delivered actionable results against a banking application, confirming SQL injection, authentication bypass, and insecure object references [24][25]. Strix held 74,375 GitHub stars [26].
PentestGPT v2, using a Tool Layer with TDA-EGATS memory, scored 85% on XBOW, completing 12 of 13 machines and 4 of 5 hosts when evaluated with GPT-5 [27]. PentestAgent, a multi-agent system with RAG and phase-based planning, scored 49% on XBOW [27]. VulnBot, using tri-phase multi-agent planning, scored 45% [27].
CAI (Cybersecurity AI) supports 300+ model backends with self-hosted LLM capability for air-gapped environments [24]. It was archived and relicensed as of October 2026, but forked copies persist, creating unpatched supply-chain exposure [14][25].
The remainder (RedAmon, MAPTA, BugTraceAI, Nebula, hackingBuddyGPT, AutoPentester, CyberStrike) span architectures from Neo4j-backed autonomous red team agents (RedAmon) [27] to multi-agent web pentesting frameworks (MAPTA, MIT-licensed) [32] to AI-assisted engagement platforms (Nebula) [31]. CyberStrike, distinct from CyberStrikeAI, is a terminal-based offensive security harness with 13+ specialized agents and 7,600+ security skills [23].
IOC Table
| Type | Value | Context | Source |
|---|---|---|---|
| Folder | C:\ProgramData\artx5v\ |
ARTEX artifact on disk | [2][4] |
| Domain | nginxmysql.com |
Vapor Panda C2 | [8] |
| IP | 45.153.126.223 |
Vapor Panda C2 | [8] |
| Domain | sqlserver-sqlite.com |
Vapor Panda C2 | [8] |
| IP | 89.46.234.50 |
Vapor Panda C2 | [8] |
| Domain | www.ddduuuppp.com |
Vapor Panda C2 | [8] |
| IP | 192.121.47.20 |
Vapor Panda C2 | [8] |
| IP | 144.172.64.99 |
Storm-0940 password spray | [8] |
| IP | 144.172.64.128 |
Storm-0940 vendor-credential sign-in | [8] |
| IP | 144.172.64.60 |
Storm-0940 failed user logins | [8] |
| Filename | BrDifxapi.exe |
BloodAlchemy loader (Vapor Panda) | [34] |
| Filename | BrDifxapi.dll |
BloodAlchemy payload (Vapor Panda) | [34] |
| Filename | graphics-hook-filter64.dll |
BloodAlchemy artifact | [8] |
| Filename | graphics-hook_config.bin |
BloodAlchemy artifact | [8] |
| Malware | HexStrike AI |
Open-source offensive framework abused for n-day exploitation | [20] |
MITRE ATT&CK Mapping
| Technique ID | Name | Context |
|---|---|---|
| T1195 | Supply Chain Compromise | Storm-0940 abuse of ConnectWise application credentials [9] |
| T1190 | Exploit Public-Facing Application | ARTEX agents exploiting SAML/XXE and internet-facing services [6] |
| T1078.004 | Valid Accounts: Cloud Accounts | OAuth application credential abuse for M365 tenant access [9][10] |
| T1110.003 | Brute Force: Password Spraying | 2,900 attempts/min against downstream tenants [11][12] |
| T1098.001 | Account Manipulation: Additional Cloud Credentials | Application credential modification for persistence [10] |
| T1098.003 | Account Manipulation: Additional Cloud Roles | Privileged role self-assignment [10] |
| T1528 | Steal Application Access Token | OAuth token theft via compromised ConnectWise apps [11] |
| T1505.003 | Server Software Component: Web Shell | JSP webshells written via MySQL log poisoning [5] |
| T1003.006 | OS Credential Dumping: DCSync | DCSync and Golden Ticket post-compromise (CyberStrikeAI) [19] |
| T1558.001 | Steal or Forge Kerberos Tickets: Golden Ticket | Golden Ticket activity after domain compromise [19] |
| T1046 | Network Service Discovery | ARTEX agent reconnaissance and network scanning [6][9] |
| T1071 | Application Layer Protocol | C2 via 491 rotating webhook.site URLs [5] |
| T1199 | Trusted Relationship | ConnectWise multi-tenant application trust exploitation [9] |
| T1606.002 | Forge Web Credentials: SAML Tokens | Cloud credential harvesting through SAML/XML weaknesses [6] |
| T1087.004 | Account Discovery: Cloud Account | Microsoft Graph reconnaissance of tenant accounts [9][10] |
Host-Based Indicators
Hunt for the folder C:\ProgramData\artx5v\ and processes or command lines containing artex, artx, or art18- [2][4]. ARTEX probe files follow the naming pattern artex-probe-* with five-digit incremental numbers; the same pattern appears in created account names, passwords, and email subjects [5]. Cloud roles starting with artx are another indicator [4].
Network Signatures
ARTEX consoles expose a Next.js frontend detectable by page title combined with Next.js static assets [3]. Censys uses this combination for identification. Monitor for high-volume outbound requests to webhook.site URLs, which ARTEX used for C2 exfiltration across 491 rotating endpoints [5]. Bursts of API calls that exceed human-plausible frequency (e.g., 2,900 sign-in attempts per minute) are a strong behavioral signal [11][12].
Identity and Cloud Telemetry
For the Storm-0940 campaign specifically, audit OAuth application credential changes in Entra ID, particularly modifications to client secrets and certificates on app registrations and service principals [10]. Alert on application-only sign-ins from ConnectWise-associated service principals to tenants outside normal patterns. Review Microsoft Graph API calls for reconnaissance patterns: enumeration of users, roles, and application registrations in rapid succession [9].
CyberStrikeAI Detection
Kaspersky Endpoint Detection and Response detected CyberStrikeAI behaviors including credential dumping and malicious scheduled tasks; network detection identified C2 traffic and suspicious domain-mapping queries [18]. Monitor Active Directory replication permissions and investigate DCSync activity from systems or accounts without replication-administration roles [19].
Sigma Rule: ARTEX Artifact Detection
title: ARTEX Framework Host Artifacts
id: f7a1c3e2-9b4d-4e8f-a6d1-3c5b7e9f2a04
status: experimental
author: RedSheepSec
date: 2026/11/09
description: Detects ARTEX pentesting framework artifacts on disk or in process command lines
logsource:
category: process_creation
product: windows
detection:
selection_cmdline:
CommandLine|contains:
- 'artex'
- 'artx'
- 'art18-'
- 'artex-probe-'
selection_folder:
TargetFilename|contains: 'ProgramData\\artx5v'
condition: selection_cmdline or selection_folder
falsepositives:
- Authorized penetration testing using the ARTEX framework
level: high
tags:
- attack.execution
- attack.command_and_controlAnalysis
The convergence of reporting from Microsoft, CrowdStrike, Google/Mandiant, Kaspersky, Censys, Wiz, and CERT-In within a six-week window (late September through early November 2026) confirms that agentic AI pentest frameworks have crossed from proof-of-concept into operational use by both state-sponsored and financially motivated groups. The diversity of actors is notable: Storm-0940 (China-state, supply chain focus), Vapor Panda (China-nexus espionage), Crafty Falcon (financial targeting in India), and unattributed operators hitting education sectors in Latin America and Africa. These groups share tooling but not objectives or tradecraft.
The operational tempo is the core concern. Storm-0940 compressed the timeline from initial targeting to privileged cloud access to under three hours [9]. Vapor Panda hit 200+ organizations across 14 countries in 11 days with confirmed post-exploitation at nine [6]. The CyberStrikeAI case showed domain admin reached in three to four days with the final lateral movement, credential collection, and database export completed in under an hour [19]. These timelines leave conventional detection and response workflows insufficient unless automated countermeasures are in place.
The 1,465 exposed ARTEX consoles observed by Censys, 10.6% co-located with other offensive tools, suggest a population of operators that extends well beyond the campaigns that have been publicly attributed [1][3]. The 32 open directories exposing post-exploitation kits indicate poor operational security among many ARTEX users, which presents both a threat (more actors using the tool) and an opportunity (exposed infrastructure is discoverable).
Red Sheep Assessment
Confidence: Moderate-High
The sources collectively point to a conclusion none state explicitly: the four frameworks confirmed in incidents represent a small and visible fraction of actual operational use. Censys found 815 distinct-looking ARTEX deployments, yet public reporting covers campaigns tied to roughly a dozen threat clusters. The gap between deployed infrastructure and attributed campaigns is large. Many of these operators are likely conducting pre-positioning or target development that hasn't yet resulted in a disclosed breach.
The second-wave tools on the RuntimeWire list deserve attention not because they'll inevitably appear in intrusion reports, but because their architecture is converging on the same pattern ARTEX uses: replaceable LLM backends, Docker-sandboxed tool execution, and looping agent planners. Shannon's 96.15% XBOW score [27][29] and Strix's 74,375 GitHub stars [26] indicate tools with both technical capability and broad adoption. The barrier to converting any of these from authorized testing into unauthorized intrusion is configuration, not engineering.
An alternative interpretation is that the public incident reporting overstates the autonomous capability of these tools and that the intrusions still required substantial human operator guidance. The Kaspersky CyberStrikeAI case partially supports this: operators performed manual preparation on the SQL Server before deploying the agent [17][18]. However, Microsoft's description of Storm-0940 operating "at machine speed" with 2,900 sign-in attempts per minute and automated OAuth abuse across 2,250+ tenants argues against this being primarily human-driven activity [9][11].
Defenders should plan for a steady expansion of agentic offensive tooling rather than a sudden spike. The tools are open source. The LLM backends are cheap and widely available. The skill floor for operating them drops with each release.
Defender's Checklist
- ▢[ ] Hunt for ARTEX host artifacts: search for
C:\ProgramData\artx5v\, command lines containingartex,artx,art18-, orartex-probe-, and cloud roles prefixed withartxacross EDR telemetry [2][4][5] - ▢[ ] Audit all OAuth application credentials and service principal permissions in Entra ID, focusing on ConnectWise-associated applications; alert on any credential rotation or role assignment not tied to a change ticket [9][10]
- ▢[ ] Deploy rate-limiting and anomaly detection on authentication endpoints; alert on sign-in volumes exceeding human-plausible thresholds (e.g., >100 attempts/minute from a single source) [11][12]
- ▢[ ] Scan external attack surface for exposed ARTEX, PentAGI, Cairn, or CyberStrikeAI consoles using Censys, Shodan, or equivalent; the ARTEX console is identifiable by its Next.js page title and static asset structure [3]
- ▢[ ] Monitor Active Directory for DCSync activity from non-replication accounts and review scheduled task creation on database servers, particularly Microsoft SQL Server instances [18][19]
References
- Infosecurity Magazine: ARTEX Offensive AI Tool Activity Far Exceeds Reported Campaigns
- Mindfort: How to Defend Against ARTEX
- Censys: ARTEX: Agentic Asbestos
- Brandefense: ARTEX AI Pentest Framework Profile
- Google Cloud / GTIG / Mandiant: ARTEX and Friends: Enter Agentic Offensive Frameworks
- Cybersecurity Dive: Agentic pen-testing tool employed in multiple espionage campaigns
- Threat Landscape Blog: ARTEX: Open-Source Agentic Pentest Framework Used in Attacks
- SOCRadar: ARTEX AI Pentest Tool: What Security Teams Need to Know
- Microsoft Security Blog: Storm-0940 Uses ARTEX Agentic AI in ConnectWise Supply Chain Compromise
- The Hacker News: China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
- Aviatrix: Storm-0940 ARTEX AI Attack: ConnectWise Supply Chain Compromise
- Aviatrix: Storm-0940 ConnectWise Supply-Chain Attack: AI-Driven Intrusion via ARTEX
- Mallory AI: Storm-0940 Linked to AI-Assisted ConnectWise Supply-Chain Compromise
- RuntimeWire: 18 Offensive AI Packages Defenders Should Watch
- Ministry of Cyber Affairs: Cybersecurity Checklist in the Agentic Hacking Era
- NationPathIndia: CERT-In Warns of Crafty Falcon AI Cyberattacks on Indian Banks
- Brandefense: CyberStrikeAI Attacks: How the Tool Works
- EnterpriseIT World MEA: AI-Powered Cyberattacks Target Educational Institutions
- AICybr: CyberStrikeAI: One LLM-Orchestrated Intrusion Reached Domain Admin in Days
- HackMag: Hackers Are Using the HexStrike AI Tool to Exploit Newly Disclosed Vulnerabilities
- The Hacker News: Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws
- Google Cloud / GTIG / Mandiant: ARTEX and Friends (Hexstrike/CAIRN coverage)
- GitHub: skyvanguard/awesome-ai-pentesting
- AppSec Santa: AI Pentesting Agents: The Rise of 39+ Tools Tested
- Ostorlab: 9 Open-Source AI Pentesting Tools Compared
- AI Pentesting Tools: Open-Source: 20 Pentest Agents Compared
- GitHub: insidetrust/awesome-ai-pentest
- Strobes: 10 Best Open Source Agentic Pentesting Tools
- GitHub: Shannon: Fully autonomous AI hacker
- GitHub: BugTraceAI
- GitHub: berylliumsec/nebula
- GitHub: arthurgervais/mapta
- Security Arsenal: Storm-0940 ConnectWise Supply Chain Compromise Detection
- Decryption Digest: Vapor Panda ARTEX: AI Hits 140+ Targets in 11 Days