ARTEX Agentic AI Framework Adopted by PRC, DPRK, and Criminal Actors Across Financial, Defense, and Cloud Targets

ARTEX Is Active in Real Intrusions Across Multiple Threat Clusters

ARTEX, an open-source agentic AI penetration testing framework written in Go and released on GitHub in July 2026 by a developer using the handle "Autumn-27," is now confirmed in offensive operations by at least five distinct threat clusters [12][16]. CERT-EU, Microsoft Threat Intelligence, CrowdStrike, Google Threat Intelligence Group (GTIG)/Mandiant, Zscaler ThreatLabz, and Palo Alto Networks Unit 42 have each published findings documenting its use since late August 2026 [1][5][7][9][2]. The original repository accumulated more than 12,000 forks before the author converted it to closed source in October 2026 after misuse reports [13]. That action came too late. Archived copies, translations, and rebranded derivatives ("ARTEX PRO," "ScopeWeaver") continue to circulate [7][12]. As of November 4, 2026, Censys counted 1,465 hosts running an exposed ARTEX console on the public internet [11].

The operational tempo these agents produce is the central problem. Microsoft documented one case where an ARTEX agent moved from scanning public GitHub repositories for leaked OAuth secrets to exfiltrating data from an Azure Key Vault in five minutes [4]. In the Storm-0940 ConnectWise supply chain compromise, multiple instances of targeting-to-privileged-cloud-access took under three hours[3]. CrowdStrike observed ARTEX generating commands as often as every 10 seconds, exceeding 1,500 commands per hour compared to the roughly 40 per hour typical in human hands-on-keyboard intrusions [5].

What ARTEX Is and How It Operates

ARTEX is an LLM-driven autonomous penetration testing platform. An operator provides a target and an objective in natural language. ARTEX decomposes that objective into goals and intents, then dispatches one or more agent workers to execute reconnaissance, vulnerability testing, and exploitation steps using real tooling rather than simulated actions [1]. The framework does not ship with its own AI model. It integrates with external LLM providers chosen by the operator, which means blocking a single AI vendor does not stop it [1][11].

The tool includes a human operator dashboard covering task orchestration, traffic recording, findings, coverage, and an approval queue [1]. Scope restrictions rely on configurable rules and the model itself; there is no hard technical enforcement preventing the agent from exceeding scope [1]. Microsoft describes ARTEX as capable of carrying out attacks "from reconnaissance through data exfiltration with little needed human interaction" [16]. The agents run continuously, on weekends and holidays, testing multiple breach paths simultaneously.

GTIG and Mandiant observed that rather than deploying complex malware, ARTEX often weaponized built-in application features [9]. During access-probing efforts, ARTEX generated files with the filename pattern artex-probe-*, where the asterisk carried five-digit somewhat-incremental numbers [9]. Similar incremental numeric markers appeared within created account names, their passwords, and within email subjects [9].

Storm-0940 (China-State-Aligned)

As early as September 2026, Storm-0940 used ARTEX to automate attacks against hundreds of organizations globally across government, military, aerospace and defense, energy, and financial services sectors[3]. Microsoft assesses Storm-0940 was responsible for the ConnectWise Cloud Backup supply chain compromise. The actor took control of several ConnectWise cloud application identities, then used stolen application credentials to authenticate into Microsoft 365 customer environments as those applications without requiring interactive user sign-in. Following unauthorized access, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants, enumerating cloud resources and reading secrets at scale across multiple Azure Key Vaults, including key enumeration and key-unwrapping operations[3]. Post-compromise activity observed through Microsoft Graph included reconnaissance, application credential changes, and attempts to modify privileges for persistent access. Wiz has since observed the group targeting additional IT and software vendors to reach their customers' data [12].

Separately, on November 5, Microsoft published research showing threat actors using ARTEX to search GitHub for exposed OAuth application secrets, sign in as service principals, and move through Azure and Microsoft 365 tenants [4]. In one case the full attack chain completed in five minutes [4].

VAPOR PANDA (China-Nexus)

CrowdStrike published attribution on October 29, 2026, linking a separate ARTEX campaign to Vapor Panda starting October 17 [5]. Over 11 days, Vapor Panda targeted more than 200 organizations in at least 14 countries [5][6]. Roughly 70% of targets were confirmed compromised or had evidence indicating moderate confidence of a successful intrusion [5]. Targets and confirmed victims include foreign ministries, a European country's presidency and prime minister's office, defense and intelligence agencies, 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors, and telecom providers in the United States, Belgium, and the Philippines [5][6][14].

Vapor Panda paired ARTEX with DeepSeek and a second, unidentified commercial language model[6]. The attackers issued instructions in Chinese and intervened only at key decision points [6][14]. Post-exploitation at confirmed victims included deployment of the BLOODALCHEMY backdoor via DLL sideloading, extraction of Active Directory LAPS administrator passwords and BitLocker recovery keys, and use of a compromised AD service account to query password-bearing directory attributes [18]. At the Greek government entity, AI agents forged an administrator token and read mailboxes by leveraging authentication keys from a 2022 mail-server directory export [6].

Storm-3358 (Cambodia-Based, Financially Motivated)

On November 6, 2026, Microsoft reported that Storm-3358, a Cambodia-based intrusion cluster, began using ARTEX against financial sector organizations in October 2026, primarily in Southeast Asia with a smaller number of large financial organizations globally [11][17]. ARTEX agents scanned internet-facing systems, exploited anonymous file upload and server-side request forgery (SSRF), then used curl and netcat to download open-source remote access tools: WISP, vshell, and AdaptixC2 [11][17].

South Korean Financial Sector Campaign (Unattributed Chinese-Speaking Actor)

From late September to early October 2026, several South Korean financial organizations experienced data breaches [10]. Zscaler ThreatLabz confirmed the campaign resulted in exfiltration of personally identifiable information belonging to approximately 67,000 individuals [2]. CrowdStrike's analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files [10]. The ARTEX instance used DeepSeek v4.1-flash as the primary LLM backend, supplemented with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions [10]. CrowdStrike assesses with moderate confidence the actor is a financially motivated Chinese speaker [10].

Onyx Sleet and Pearl Sleet (North Korea-Linked)

Microsoft Threat Intelligence tracks both Onyx Sleet and Pearl Sleet as ARTEX users since late October 2026 [16]. The sources do not specify the full scope of their campaigns.

DIVD Breach (Unattributed Agentic Threat Actor)

On September 21, 2026, an agentic threat actor breached the Dutch Institute for Vulnerability Disclosure (DIVD) by chaining two zero-day vulnerabilities in the Zammad helpdesk platform: CVE-2026-102489 (CVSS 9.8 per NVD) and CVE-2026-102490 [15][7][8]. The agent went from a hijacked session to root access in 12 minutes [6]. DIVD recorded over 450,000 requests and 2,500 scripts connected to the attack, describing the activity as "super loud and messy" [6][15].

Additional Incidents

Blockchain infrastructure provider Chainstack disclosed on November 5 that an attacker gained unauthorized access through a third-party component on October 26, escalated to production on the same day, and was detected on October 31 [8]. The breach is assessed to share overlaps with a China-linked ARTEX campaign [8]. API platform WorkOS disclosed a separate incident in which a security researcher's ARTEX agent escaped its isolated testing environment and breached an internal application [12]. Unit 42 observed intrusion attempts between September 24 and October 27 that likely used ARTEX or an ARTEX-derived framework against government Linux servers [7].

Initial Access

ARTEX operators have been observed gaining initial access through multiple vectors: exploitation of internet-facing web applications (including anonymous file upload and SSRF) [11][17], abuse of stolen OAuth application credentials, compromised vendor applications, leaked secrets on public GitHub [4], and Zammad zero-days [15]. The framework's agents generate large volumes of GitHub queries combining a target company name with secret keywords and cloud or AI service names [4].

Reconnaissance and Credential Abuse

Once inside, ARTEX agents perform rapid enumeration. Over a span of 500+ web requests, ARTEX probed various filenames and extensions across web directories to fuzz which URL endpoints the web server would allow based on HTTP response code [9]. ARTEX ran an 8-second ARM deployments/validate dry-run sweep across 11 Azure resource types [9]. In Active Directory environments, GTIG and Mandiant documented Kerberoasting to DCSync attack chains.

Lateral Movement and Privilege Escalation

Lateral movement attempts onto domain controllers used Pass-the-Ticket, WinRM, Kerberos relay, and Pass-the-Hash scripts [9]. The agents hit local Windows service token privilege restrictions right before endpoint protection blocked execution [9]. In the DIVD breach, the agent performed tasks simultaneously: reading a compromised mailbox, scanning the internal network, extracting login tokens, and attempting password resets [6].

Persistence and Exfiltration

Post-compromise tooling varies by actor. Vapor Panda deployed BLOODALCHEMY via DLL sideloading [14][18]. Storm-3358 installed WISP, vshell, and AdaptixC2 [11][17]. Storm-0940 added credentials to existing OAuth applications for persistent access through Microsoft Graph. Multiple actors abused webhook.site URLs for data exfiltration [16].

Indicators of Compromise

MITRE ATT&CK Mapping

Detection and Hunting

GTIG stated directly: "Tool names, hashes, IP addresses, and other static indicators provide useful signals when available, but they will not cover much of this activity" [9]. Behavioral detection is the primary path.

Host-Based Indicators

• Hunt for the directory C:\ProgramData\artx5v\ and filenames matching artex-probe-* with five-digit numeric suffixes[9][16].
• Look for artx or artex strings in command-line telemetry across EDR platforms [16].
• ARTEX agents leave conversational, step-by-step reasoning notes in scripts rather than standard developer documentation. Flag scripts containing natural-language explanations of their own logic [7].

Network and API Indicators

• Monitor for outbound connections to known LLM API endpoints: api.deepseek.com, open.bigmodel.cn, api.x.ai, api.anthropic.com from servers that have no authorized AI workload [2].
• Alert on bursts of API calls at rates no human operator could produce. ARTEX has been observed exceeding 1,500 commands per hour [5].
• In Azure environments, watch for test blob write-and-delete operations completing in 330 to 400 ms and ARM deployments/validate dry-run sweeps across multiple resource types in seconds [9].

Cloud-Specific Detection

• In Microsoft 365 and Entra ID, alert on application sign-ins from applications with broad delegated permissions that suddenly authenticate to large numbers of tenants.
• Flag bulk secrets/list and keys/unwrapKey operations across multiple Azure Key Vaults from a single service principal in a short window[3].
• Monitor Microsoft Graph API calls for rapid sequences of application.ReadWrite.All or RoleManagement.ReadWrite.Directory that follow a new service principal sign-in.

Sigma Rule: ARTEX Directory and Filename Artifacts

title: ARTEX Framework Host Artifacts
id: a3f8c1e0-7d42-4b9a-bc10-2026artx0001
status: experimental
author: RedSheepSec
date: 2026/11/09
description: Detects creation of ARTEX-associated directories and probe files on Windows endpoints
logsource:
  category: file_event
  product: windows
detection:
  selection_dir:
    TargetFilename|contains: '\ProgramData\artx5v\'
  selection_probe:
    TargetFilename|contains: 'artex-probe-'
  condition: selection_dir or selection_probe
falsepositives:
  - Authorized penetration testing using ARTEX
level: high
tags:
  - attack.execution

Sigma Rule: Rapid Azure Key Vault Secret Enumeration

title: Rapid Azure Key Vault Secret Enumeration
id: a3f8c1e0-7d42-4b9a-bc10-2026artx0002
status: experimental
author: RedSheepSec
date: 2026/11/09
description: Detects a single principal reading secrets from multiple Key Vaults in a short window, consistent with ARTEX agentic behavior
logsource:
  product: azure
  service: keyvault
detection:
  selection:
    operationName|contains:
      - 'SecretList'
      - 'SecretGet'
      - 'KeyUnwrap'
  timeframe: 5m
  condition: selection | count(resourceId) by callerIpAddress > 5
falsepositives:
  - Backup or secret rotation automation
level: high
tags:
  - attack.credential_access
  - attack.t1552

Analysis

ARTEX compresses attack timelines to machine speed. As GTIG noted, these frameworks "currently trade stealth for velocity" [7]. That tradeoff gives defenders a window: the activity is loud. DIVD recorded 450,000 requests and 2,500 scripts from a single intrusion [6]. CrowdStrike measured command rates 37 times higher than typical human operations [5]. The noise is substantial, but only useful to organizations already collecting the right telemetry at the right volume.

The adoption pattern is notable. Within three months of ARTEX's public release in July 2026, five distinct clusters spanning PRC-state espionage (Storm-0940, Vapor Panda), DPRK intelligence collection (Onyx Sleet, Pearl Sleet), Cambodian financial crime (Storm-3358), and unattributed actors were all running it in production[12][16]. ARTEX joins Cobalt Strike, Metasploit, and Sliver in the category of legitimate offensive tools adopted wholesale by adversaries, but the autonomous agentic capability adds a multiplier: a single operator can direct campaigns against hundreds of organizations simultaneously [5].

The ConnectWise supply chain operation stands out. Storm-0940 chained ARTEX's speed with trusted vendor relationships to reach 2,250+ downstream tenants[3]. The lesson for defenders is that identity hygiene (secret rotation, scope reduction, conditional access) is the primary countermeasure. ARTEX exploits weak identity hygiene and exposed services; there is no vulnerability to patch in the framework itself.

Framework takedowns have limited effect. The original repository is closed, but 12,000+ forks persisted, and derivatives like ARTEX PRO and ScopeWeaver are actively maintained [7][12][13]. Other agentic offensive frameworks (Hexstrike, CAIRN, PentAGI) have also been observed in intrusions [9]. The capability class is here to stay.

References

[1] https://cert.europa.eu/blog/from-penetration-testing-to-cyber-threat-beware-of-artex

[2] https://www.zscaler.com/blogs/security-research/threat-actor-abuses-agentic-ai-pentesting-framework-target-south-korean

[3] https://www.blackberry.com/en/secure-communications/security-briefing-center/connectwise-cloud-backup-compromise-storm-0940

[4] https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/

[5] https://cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/

[6] https://www.bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs/

[7] https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html

[8] https://thehackernews.com/2026/11/chainstack-reports-production-systems.html

[9] https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks

[10] https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/

[11] https://www.upwind.io/blog/artex-reaches-the-financial-sector-what-storm-3358s-agentic-attacks-look-like-in-the-cloud

[12] https://www.helpnetsecurity.com/2026/11/09/artex-goes-from-pentesting-tool-to-attacker-staple-in-three-months/

[13] https://hard2bit.com/en/blog/storm-0940-artex-connectwise-ai-attack-microsoft-365/

[14] https://finance.biggo.com/news/0e961de1-dbbd-4d22-bfdc-974a15ae4a5f

[15] https://www.sysdig.com/blog/ai-agent-exploits-zammad-zero-days-in-divd-breach-what-we-know-and-how-to-detect-it

[16] https://brandefense.io/knowledge-hub/malware/artex/

[17] https://infrastack.ai/live/CMP-202611-2c2zog

[18] https://www.decryptiondigest.com/blog/vapor-panda-artex-ai-cyberattack-140-targets

Hunt Guide: ARTEX Agentic AI Framework Adopted by PRC, DPRK, and Criminal Actors Targeting Financial, Defense, and Cloud Infrastructure

Attribution: Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher) and carry an attribution credit. Rules without a credit were authored in-house by RedSheepSec. If you reuse a rule, preserve its stated attribution.

Hypothesis: If ARTEX-enabled threat actors (Storm-0940, Vapor Panda, Storm-3358, Onyx Sleet) are active in our environment, we expect to observe outbound connections to known ARTEX C2 infrastructure and LLM API endpoints, probe file creation patterns (artex-probe-*), JSP web shell deployment, BLOODALCHEMY DLL sideloading artifacts, and password-spray activity originating from ARTEX relay nodes, visible in firewall logs, Sysmon process creation events, DNS resolution logs, web server access logs, and EDR telemetry.

Intelligence Summary: Multiple state-sponsored and criminal threat groups, including PRC-nexus actors Vapor Panda and Storm-0940, DPRK-nexus Onyx Sleet, and financially motivated Storm-3358, have adopted the ARTEX agentic AI penetration testing framework for offensive operations since late September 2026. ARTEX leverages LLM API calls (Anthropic, DeepSeek, BigModel, xAI) to autonomously conduct reconnaissance, exploitation, and post-exploitation against financial institutions, defense agencies, foreign ministries, and cloud environments. CrowdStrike documented over 140 targets across at least 14 countries, with confirmed intrusions at South Korean financial institutions via MySQL log poisoning and JSP web shell deployment, and Vapor Panda deploying BLOODALCHEMY implants through DLL sideloading.

Confidence: High | Priority: Critical

Scope

• Networks: All enterprise network segments including DMZ, internal server VLANs, cloud workloads (AWS, Azure, Oracle Cloud), and VPN concentrators. Priority on internet-facing web application servers, database servers (MySQL), and authentication infrastructure.
• Timeframe: 90 days retrospective (late August 2026 to present). ARTEX activity was first documented in late September 2026, with Storm-3358 infrastructure first observed 28 October 2026. Sweep should cover at minimum from 1 September 2026.
• Priority Systems: Internet-facing web application servers (especially Java/Tomcat/JSP environments), MySQL database servers, Azure AD/Entra ID authentication infrastructure, financial application servers, defense-related systems, cloud management consoles, and any systems with outbound access to LLM API endpoints.

MITRE ATT&CK Techniques

T1110.003: Password Spraying (Credential Access) [P1]

Storm-0940 uses ARTEX-coordinated password-spray campaigns against targets, distributing attempts across relay proxy infrastructure (144.172.64.0/24 range and 187.15.x.x addresses) to evade rate-limiting and account lockout thresholds.

Splunk SPL:

index=winevent sourcetype="XmlWinEventLog:Security" EventCode=4625 
| bin _time span=10m 
| stats count dc(TargetUserName) as unique_users values(TargetUserName) as targeted_accounts by src_ip _time 
| where count > 25 AND unique_users > 5 
| lookup dnslookup clientip as src_ip OUTPUT clienthost as src_hostname 
| table _time src_ip src_hostname count unique_users targeted_accounts

Elastic KQL:

event.code:"4625" AND winlog.event_data.Status:"0xC000006D" | stats count by source.ip, @timestamp

Sigma Rule:

title: High-Volume Password Spray from Single Source
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
author: RedSheepSec
date: 2026/11/16
description: Detects password spray activity consistent with ARTEX-coordinated Storm-0940 campaigns
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
  timeframe: 10m
  condition: selection | count() by SourceNetworkAddress > 25
falsepositives:
  - Legitimate load balancers or VPN concentrators generating multiple failed logins
  - Automated service accounts with expired credentials
level: high
tags:
  - attack.credential_access
  - attack.t1110.003

Tune the threshold based on environment baseline. Storm-0940 distributes attempts across multiple proxy IPs to stay below per-IP thresholds; correlate across the 144.172.64.0/24 range as a group. Azure AD environments should also query sign-in logs for AADSTS50126 error codes.

T1059.001: PowerShell (Execution) [P2]

ARTEX framework generates and executes PowerShell commands as part of its autonomous post-exploitation workflow. The agentic AI constructs PowerShell one-liners for reconnaissance, credential harvesting, and lateral movement.

Splunk SPL:

index=powershell sourcetype=XmlWinEventLog EventCode=4104 
| eval lower_script=lower(ScriptBlockText) 
| where like(lower_script, "%artex%") OR like(lower_script, "%invoke-expression%") OR like(lower_script, "%iex%") OR like(lower_script, "%downloadstring%") OR like(lower_script, "%webhook.site%") OR like(lower_script, "%api.anthropic.com%") OR like(lower_script, "%api.deepseek.com%") 
| table _time host ScriptBlockText UserName

Elastic KQL:

event.code:"4104" AND (powershell.file.script_block_text:*artex* OR powershell.file.script_block_text:*webhook.site* OR powershell.file.script_block_text:*api.anthropic.com* OR powershell.file.script_block_text:*api.deepseek.com*)

Sigma Rule:

title: ARTEX Related PowerShell Execution
id: b2c3d4e5-f6a7-4b5c-9d0e-1f2a3b4c5d6e
status: experimental
author: RedSheepSec
date: 2026/11/16
description: Detects PowerShell script blocks containing ARTEX framework references or known ARTEX C2 domains
logsource:
  product: windows
  category: ps_script
detection:
  selection_artex:
    ScriptBlockText|contains:
      - 'artex'
      - 'artex-probe'
  selection_c2:
    ScriptBlockText|contains:
      - 'webhook.site'
      - 'api.anthropic.com'
      - 'api.deepseek.com'
      - 'open.bigmodel.cn'
      - 'api.x.ai'
      - 'xcai.pro'
  condition: selection_artex or selection_c2
falsepositives:
  - Legitimate penetration testing using ARTEX with authorization
  - Developer references to Anthropic API for authorized purposes
level: high
tags:
  - attack.execution
  - attack.t1059.001

The api.anthropic.com and api.deepseek.com domains are legitimate AI services. Context is critical: flag when these appear in PowerShell execution contexts, not in browser traffic from development workstations. Coordinate with authorized AI usage policies before escalating.

T1505.003: Web Shell (Persistence) [P1]

Vapor Panda deployed JSP web shells (cl1217.jsp, f1219a.jsp, z1219.jsp) via MySQL log poisoning on South Korean financial institution web servers. ARTEX autonomously writes these shells as part of its exploitation chain.

Splunk SPL:

index=sysmon sourcetype=XmlWinEventLog EventCode=11 
| where match(TargetFilename, "(?i)\.(jsp|jspx|ashx|aspx|php|cfm)$") 
| eval suspicious=if(match(TargetFilename, "(?i)(cl1217|f1219a|z1219|artex)"), "HIGH", "MEDIUM") 
| stats count values(TargetFilename) as files values(Image) as creating_process by Computer suspicious 
| where creating_process!="*javac*" AND creating_process!="*deploy*" 
| sort - suspicious 
| table Computer suspicious files creating_process count

Elastic KQL:

event.code:"11" AND file.extension:(jsp OR jspx OR aspx OR ashx OR php OR cfm) AND NOT process.name:(javac OR deploy*)

Sigma Rule:

title: JSP Web Shell Creation Consistent with ARTEX Vapor Panda Activity
id: c3d4e5f6-a7b8-4c5d-0e1f-2a3b4c5d6e7f
status: experimental
author: RedSheepSec
date: 2026/11/16
description: Detects creation of JSP files matching known Vapor Panda web shell naming convention or creation by non-standard processes
logsource:
  product: windows
  category: file_event
detection:
  selection_filename:
    TargetFilename|endswith:
      - 'cl1217.jsp'
      - 'f1219a.jsp'
      - 'z1219.jsp'
  selection_generic_jsp:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
    Image|contains:
      - 'mysql'
      - 'java'
      - 'tomcat'
      - 'cmd.exe'
      - 'powershell'
  condition: selection_filename or selection_generic_jsp
falsepositives:
  - Legitimate Java application deployments
  - CI/CD pipelines deploying JSP applications
level: critical
tags:
  - attack.persistence
  - attack.t1505.003

The specific filenames cl1217.jsp, f1219a.jsp, z1219.jsp are confirmed Vapor Panda artifacts. Generic JSP creation by mysql or cmd.exe processes is highly suspicious regardless of filename. Baseline normal deployment activity for your Java application servers.

T1574.002: DLL Side-Loading (Persistence) [P1]

Vapor Panda uses DLL sideloading through a renamed legitimate Dell utility (BrDifxapi.exe) that loads a malicious BrDifxapi.dll, which in turn loads the BLOODALCHEMY implant. The renamed GameHook executable (svchost.exe) also sideloads graphics-hook-filter64.dll.

Splunk SPL:

index=sysmon sourcetype=XmlWinEventLog EventCode=7 
| where match(ImageLoaded, "(?i)(graphics-hook-filter64\.dll|BrDifxapi\.dll|graphics-hook_config\.bin)") OR (match(Image, "(?i)svchost\.exe") AND NOT match(Image, "(?i)C:\\Windows\\System32\\svchost\.exe")) 
| table _time Computer Image ImageLoaded Hashes Signed SignatureStatus 
| sort _time

Elastic KQL:

(event.code:"7" AND (dll.name:("graphics-hook-filter64.dll" OR "BrDifxapi.dll") OR (process.name:"svchost.exe" AND NOT process.executable:"C:\\Windows\\System32\\svchost.exe")))

Sigma Rule:

title: BLOODALCHEMY DLL Sideloading via Renamed Dell or GameHook Executables
id: d4e5f6a7-b8c9-4d5e-1f2a-3b4c5d6e7f8a
status: experimental
author: RedSheepSec
date: 2026/11/16
description: Detects DLL sideloading artifacts associated with Vapor Panda BLOODALCHEMY implant deployment via BrDifxapi.exe or renamed GameHook svchost.exe
logsource:
  product: windows
  category: image_load
detection:
  selection_dll:
    ImageLoaded|endswith:
      - '\graphics-hook-filter64.dll'
      - '\BrDifxapi.dll'
  selection_svchost_sideload:
    Image|endswith: '\svchost.exe'
    ImageLoaded|endswith: '\graphics-hook-filter64.dll'
  filter_legit_svchost:
    Image: 'C:\Windows\System32\svchost.exe'
  condition: selection_dll or (selection_svchost_sideload and not filter_legit_svchost)
falsepositives:
  - Legitimate Dell printer utilities using BrDifxapi.dll
  - OBS Studio or streaming software using graphics-hook-filter64.dll
level: critical
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1574.002

BrDifxapi.exe is a legitimate Dell utility; its presence outside Dell installation directories is suspicious. graphics-hook-filter64.dll is also used by OBS Studio; correlate with the loading process path. Svchost.exe running from non-System32 paths is a strong indicator.

T1071.001: Web Protocols (Command and Control) [P1]

ARTEX framework communicates with LLM API endpoints (api.anthropic.com, api.deepseek.com, open.bigmodel.cn, api.x.ai) over HTTPS for agentic task execution, and exfiltrates command output via curl to webhook.site rotating URLs. Vapor Panda C2 uses custom domains (nginxmysql.com, sqlserver-sqlite.com, ddduuuppp.com) over standard web protocols.

Splunk SPL:

index=corelight sourcetype=corelight_dns 
| where match(query, "(?i)(api\.anthropic\.com|api\.deepseek\.com|open\.bigmodel\.cn|api\.x\.ai|xcai\.pro|nginxmysql\.com|sqlserver-sqlite\.com|ddduuuppp\.com|webhook\.site|server\.codeium\.com)") 
| stats count values(id.orig_h) as src_ips values(answers) as resolved_ips by query 
| sort - count 
| table query count src_ips resolved_ips

Elastic KQL:

dns.question.name:(api.anthropic.com OR api.deepseek.com OR open.bigmodel.cn OR api.x.ai OR xcai.pro OR nginxmysql.com OR sqlserver-sqlite.com OR ddduuuppp.com OR webhook.site OR server.codeium.com)

Sigma Rule:

title: DNS Resolution of ARTEX Related LLM API and C2 Domains
id: e5f6a7b8-c9d0-4e5f-2a3b-4c5d6e7f8a9b
status: experimental
author: RedSheepSec
date: 2026/11/16
description: Detects DNS queries to LLM API endpoints and C2 domains associated with ARTEX framework operations
logsource:
  category: dns
detection:
  selection_llm:
    query|endswith:
      - 'api.anthropic.com'
      - 'api.deepseek.com'
      - 'open.bigmodel.cn'
      - 'api.x.ai'
      - 'xcai.pro'
  selection_c2:
    query|endswith:
      - 'nginxmysql.com'
      - 'sqlserver-sqlite.com'
      - 'ddduuuppp.com'
  selection_exfil:
    query|endswith:
      - 'webhook.site'
  condition: selection_llm or selection_c2 or selection_exfil
falsepositives:
  - Authorized use of Anthropic, DeepSeek, or xAI APIs by development teams
  - Webhook.site used for legitimate testing
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001

LLM API domains are dual-use. Selection_c2 (nginxmysql.com, sqlserver-sqlite.com, ddduuuppp.com) are high-fidelity Vapor Panda indicators with very low false positive rates. Webhook.site is commonly used by developers for testing; correlate with the originating process and user context. Consider monitoring for the xcai.pro reseller domain which was tied to ARTEX South Korean intrusions.

T1190: Exploit Public-Facing Application (Initial Access) [P2]

ARTEX framework autonomously identifies and exploits vulnerabilities in public-facing applications. In the South Korean bank attacks, ARTEX exploited MySQL services to achieve log poisoning that led to JSP web shell deployment. Storm-3358 targeted financial sector cloud infrastructure.

Splunk SPL:

index=firewall-pan sourcetype="pan:threat" 
| where match(threat_name, "(?i)(sql.injection|command.injection|code.injection|mysql|jsp.upload)") 
| stats count values(dst_ip) as targets values(threat_name) as attack_types by src_ip 
| where count > 10 
| sort - count 
| table src_ip count targets attack_types

Elastic KQL:

event.category:"intrusion_detection" AND (rule.name:*sql*injection* OR rule.name:*command*injection* OR rule.name:*mysql* OR rule.name:*jsp*)

ARTEX's autonomous exploitation means attack patterns may appear more systematic and rapid than human-driven attacks. Look for high-velocity scanning followed immediately by targeted exploitation attempts against a single service.

T1567: Exfiltration Over Web Service (Exfiltration) [P2]

ARTEX sends command output via curl to webhook.site using 491 rotating URLs. This provides a low-infrastructure exfiltration channel that leverages a legitimate web service.

Splunk SPL:

index=corelight sourcetype=corelight_http 
| where match(host, "(?i)webhook\.site") 
| stats count sum(request_body_len) as total_bytes_out values(id.orig_h) as src_ips dc(uri) as unique_uris by host 
| where count > 5 
| table host count total_bytes_out unique_uris src_ips

Elastic KQL:

url.domain:"webhook.site" AND http.request.method:(POST OR PUT)

Sigma Rule:

title: Curl Exfiltration to Webhook.site
id: f6a7b8c9-d0e1-4f5a-3b4c-5d6e7f8a9b0c
status: experimental
author: RedSheepSec
date: 2026/11/16
description: Detects curl execution with webhook.site as destination, consistent with ARTEX framework data exfiltration
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\curl.exe'
    CommandLine|contains: 'webhook.site'
  condition: selection
falsepositives:
  - Developers using webhook.site for legitimate API testing
level: high
tags:
  - attack.exfiltration
  - attack.t1567

Webhook.site is a legitimate service frequently used by developers; context is key. High volume of unique URIs from a single host is a stronger signal. On Linux systems, monitor bash_history and audit logs for curl commands targeting webhook.site.

T1083: File and Directory Discovery (Discovery) [P1]

ARTEX creates probe files (artex-probe-* with five-digit incremental numbers) during its autonomous reconnaissance phase. The presence of these files indicates an active ARTEX scan or exploitation attempt. An open directory at http://38.244.50.120:18899/.claude/CLAUDE.md was also observed.

Splunk SPL:

index=sysmon sourcetype=XmlWinEventLog EventCode=11 
| where match(TargetFilename, "(?i)artex-probe-\d+") OR match(TargetFilename, "(?i)ArtexProbe") OR match(TargetFilename, "(?i)p\.cfg") 
| stats count values(TargetFilename) as files values(Image) as creating_process by Computer 
| table Computer count files creating_process

Elastic KQL:

event.code:"11" AND file.name:(artex-probe-* OR ArtexProbe OR p.cfg)

Sigma Rule:

title: ARTEX Probe File Creation
id: a7b8c9d0-e1f2-4a5b-4c5d-6e7f8a9b0c1d
status: experimental
author: RedSheepSec
date: 2026/11/16
description: Detects creation of ARTEX framework probe files used during autonomous reconnaissance
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - 'artex-probe-'
      - 'ArtexProbe'
  selection_config:
    TargetFilename|endswith: '\p.cfg'
  condition: selection or selection_config
falsepositives:
  - Authorized penetration testing using ARTEX framework
level: critical
tags:
  - attack.discovery
  - attack.t1083

artex-probe- files are high-fidelity indicators of ARTEX framework activity. The five-digit incremental numbering pattern is distinctive. p.cfg is the ARTEX configuration file. These files should not appear in any environment unless authorized penetration testing is underway.*

T1090: Proxy (Command and Control) [P1]

CrowdStrike documented multiple proxy infrastructure IPs used to relay ARTEX C2 traffic and obscure the true origin of attacks. Storm-0940 routes password-spray and post-exploitation traffic through these proxy nodes to complicate attribution.

Splunk SPL:

index=firewall-pan sourcetype="pan:traffic:aggregated" 
| where dest_ip IN ("101.53.80.20", "205.214.59.31", "124.155.252.63", "154.201.79.246", "23.248.249.90", "23.158.220.98", "103.248.148.84", "203.160.133.172", "209.209.85.38") OR src_ip IN ("101.53.80.20", "205.214.59.31", "124.155.252.63", "154.201.79.246", "23.248.249.90", "23.158.220.98", "103.248.148.84", "203.160.133.172", "209.209.85.38") 
| stats count sum(bytes) as total_bytes values(dest_port) as ports by src_ip dest_ip action 
| sort - count 
| table src_ip dest_ip ports total_bytes count action

Elastic KQL:

destination.ip:("101.53.80.20" OR "205.214.59.31" OR "124.155.252.63" OR "154.201.79.246" OR "23.248.249.90" OR "23.158.220.98" OR "103.248.148.84" OR "203.160.133.172" OR "209.209.85.38") OR source.ip:("101.53.80.20" OR "205.214.59.31" OR "124.155.252.63" OR "154.201.79.246" OR "23.248.249.90" OR "23.158.220.98" OR "103.248.148.84" OR "203.160.133.172" OR "209.209.85.38")

These proxy IPs are CrowdStrike-documented infrastructure. Check for any historical connections in the recommended 90-day hunt window. Cross-reference with the Storm-0940 144.172.64.x range for correlated activity.

Indicators of Compromise

IOC Sweep Queries (Splunk):

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="144.172.64.99" OR dest_ip="144.172.64.99") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="144.172.64.128" OR dest_ip="144.172.64.128") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="144.172.64.60" OR dest_ip="144.172.64.60") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="187.15.88.186" OR dest_ip="187.15.88.186") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="187.15.90.217" OR dest_ip="187.15.90.217") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="187.15.89.186" OR dest_ip="187.15.89.186") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="45.153.126.223" OR dest_ip="45.153.126.223") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="89.46.234.50" OR dest_ip="89.46.234.50") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="192.121.47.20" OR dest_ip="192.121.47.20") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="38.244.50.120" OR dest_ip="38.244.50.120") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="101.53.80.20" OR dest_ip="101.53.80.20") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="205.214.59.31" OR dest_ip="205.214.59.31") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="124.155.252.63" OR dest_ip="124.155.252.63") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="154.201.79.246" OR dest_ip="154.201.79.246") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="23.248.249.90" OR dest_ip="23.248.249.90") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="23.158.220.98" OR dest_ip="23.158.220.98") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="103.248.148.84" OR dest_ip="103.248.148.84") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="203.160.133.172" OR dest_ip="203.160.133.172") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="209.209.85.38" OR dest_ip="209.209.85.38") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="91.92.240.238" OR dest_ip="91.92.240.238") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="85.11.168.45" OR dest_ip="85.11.168.45") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="31.77.229.35" OR dest_ip="31.77.229.35") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="85.11.167.52" OR dest_ip="85.11.167.52") | stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip ports count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="199.19.95.66" OR dest_ip="199.19.95.66") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="199.19.95.67" OR dest_ip="199.19.95.67") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="199.19.95.68" OR dest_ip="199.19.95.68") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="178.16.54.129" OR dest_ip="178.16.54.129") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="178.15.54.129" OR dest_ip="178.15.54.129") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip action | table first_seen last_seen src_ip dest_ip count action

index=corelight sourcetype=corelight_dns query="api.anthropic.com" | stats count values(id.orig_h) as src_ips by query | table query count src_ips

index=corelight sourcetype=corelight_dns query="api.deepseek.com" | stats count values(id.orig_h) as src_ips by query | table query count src_ips

index=corelight sourcetype=corelight_dns query="open.bigmodel.cn" | stats count values(id.orig_h) as src_ips by query | table query count src_ips

index=corelight sourcetype=corelight_dns query="api.x.ai" | stats count values(id.orig_h) as src_ips by query | table query count src_ips

index=corelight sourcetype=corelight_dns query="*nginxmysql.com" | stats count values(id.orig_h) as src_ips values(answers) as resolved by query | table query count src_ips resolved

index=corelight sourcetype=corelight_dns query="*sqlserver-sqlite.com" | stats count values(id.orig_h) as src_ips values(answers) as resolved by query | table query count src_ips resolved

index=corelight sourcetype=corelight_dns query="*ddduuuppp.com" | stats count values(id.orig_h) as src_ips values(answers) as resolved by query | table query count src_ips resolved

index=corelight sourcetype=corelight_dns query="*xcai.pro" | stats count values(id.orig_h) as src_ips values(answers) as resolved by query | table query count src_ips resolved

index=corelight sourcetype=corelight_dns query="*webhook.site" | stats count values(id.orig_h) as src_ips by query | table query count src_ips

index=corelight sourcetype=corelight_dns query="server.codeium.com" | stats count values(id.orig_h) as src_ips by query | table query count src_ips

index=sysmon sourcetype=XmlWinEventLog (Hashes="*3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4*" OR SHA256="3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4") | stats count values(Image) as processes values(Computer) as hosts by Hashes | table hosts processes Hashes count

index=sysmon sourcetype=XmlWinEventLog (Hashes="*364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab*" OR SHA256="364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab") | stats count values(Image) as processes values(Computer) as hosts by Hashes | table hosts processes Hashes count

index=sysmon sourcetype=XmlWinEventLog (Hashes="*f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c*" OR SHA256="f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c") | stats count values(Image) as processes values(Computer) as hosts by Hashes | table hosts processes Hashes count

index=sysmon sourcetype=XmlWinEventLog (Hashes="*0837dd54268c373069fc5c1628c6e3d75eb99c3b3efc94c45b73e2cf9a6f3207*" OR SHA256="0837dd54268c373069fc5c1628c6e3d75eb99c3b3efc94c45b73e2cf9a6f3207") | stats count values(Image) as processes values(Computer) as hosts by Hashes | table hosts processes Hashes count

index=sysmon sourcetype=XmlWinEventLog (TargetFilename="*artx5v*" OR Image="*artx5v*") | stats count values(TargetFilename) as files values(Image) as processes by Computer | table Computer files processes count

index=sysmon sourcetype=XmlWinEventLog (TargetFilename="*Merman_New*" OR Image="*Merman_New*" OR TargetFilename="*ProjectX*") | stats count values(TargetFilename) as files values(Image) as processes by Computer | table Computer files processes count

index=sysmon sourcetype=XmlWinEventLog EventCode=11 TargetFilename="*artex-probe-*" | stats count values(TargetFilename) as files values(Image) as creating_process by Computer | table Computer files creating_process count

index=sysmon sourcetype=XmlWinEventLog (ImageLoaded="*graphics-hook-filter64.dll" OR TargetFilename="*graphics-hook-filter64.dll") | stats count values(Image) as loading_process values(Computer) as hosts | table hosts loading_process count

index=sysmon sourcetype=XmlWinEventLog TargetFilename="*graphics-hook_config.bin" | stats count values(Image) as creating_process values(Computer) as hosts | table hosts creating_process count

index=sysmon sourcetype=XmlWinEventLog EventCode=11 TargetFilename="*cl1217.jsp" | stats count values(Image) as creating_process by Computer TargetFilename | table Computer TargetFilename creating_process count

index=sysmon sourcetype=XmlWinEventLog EventCode=11 TargetFilename="*f1219a.jsp" | stats count values(Image) as creating_process by Computer TargetFilename | table Computer TargetFilename creating_process count

index=sysmon sourcetype=XmlWinEventLog EventCode=11 TargetFilename="*z1219.jsp" | stats count values(Image) as creating_process by Computer TargetFilename | table Computer TargetFilename creating_process count

index=sysmon sourcetype=XmlWinEventLog EventCode=11 TargetFilename="*\\p.cfg" | stats count values(Image) as creating_process by Computer TargetFilename | table Computer TargetFilename creating_process count

index=sysmon sourcetype=XmlWinEventLog EventCode=1 Image="*BrDifxapi.exe" | stats count values(ParentImage) as parent_process values(CommandLine) as cmdline by Computer Image | table Computer Image parent_process cmdline count

index=sysmon sourcetype=XmlWinEventLog EventCode=7 ImageLoaded="*BrDifxapi.dll" | stats count values(Image) as loading_process values(Computer) as hosts | table hosts loading_process count

YARA Rules

ARTEX_BLOODALCHEMY_Loader_Artifacts: Detects Vapor Panda BLOODALCHEMY implant artifacts including DLL sideloading components and configuration files based on known file hashes and string patterns

rule ARTEX_BLOODALCHEMY_Loader_Artifacts {
    meta:
        author = "RedSheepSec"
        description = "Detects Vapor Panda BLOODALCHEMY implant artifacts used in ARTEX campaigns"
        date = "2026-11-16"
        reference = "https://socradar.io/blog/artex-ai-pentest-tool-what-security-teams-need-to-know/"
        hash1 = "49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068"
        hash2 = "3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4"
        hash3 = "364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab"
    strings:
        $dll_name = "graphics-hook-filter64.dll" ascii wide
        $config_name = "graphics-hook_config.bin" ascii wide
        $path1 = "artx5v" ascii wide
        $path2 = "Merman_New" ascii wide
        $path3 = "ProjectX" ascii wide
        $loader_exe = "BrDifxapi.exe" ascii wide
        $loader_dll = "BrDifxapi.dll" ascii wide
        $hash_bytes1 = { 49 fe 70 41 9f d1 9b 81 ca 8d 73 0a 6e f7 c1 ec }
        $hash_bytes2 = { 3f b5 a9 fb 3e 2c b1 d6 20 89 66 bd 4e 55 d1 02 }
    condition:
        uint16(0) == 0x5A4D and (any of ($dll_name, $config_name, $loader_exe, $loader_dll) or 2 of ($path1, $path2, $path3) or any of ($hash_bytes*))
}

ARTEX_Probe_File_Pattern: Detects ARTEX framework probe files and configuration artifacts on disk

rule ARTEX_Probe_File_Pattern {
    meta:
        author = "RedSheepSec"
        description = "Detects ARTEX framework probe and configuration file artifacts"
        date = "2026-11-16"
        reference = "https://cybersecuritynews.com/hackers-use-artex-ai-agents/"
    strings:
        $probe = "artex-probe-" ascii wide
        $probe2 = "ArtexProbe" ascii wide
        $config = "p.cfg" ascii wide
        $claude_ref = "CLAUDE.md" ascii wide
        $artex_str = "artex" ascii wide nocase
        $agentic = "agentic" ascii wide nocase
    condition:
        any of ($probe, $probe2) or ($config and $artex_str) or ($claude_ref and $artex_str) or ($artex_str and $agentic)
}

Onyx_Sleet_SmallTiger_NukeSped: Detects Onyx Sleet SmallTiger/NukeSped malware based on known SHA256 hash fragments

rule Onyx_Sleet_SmallTiger_NukeSped {
    meta:
        author = "RedSheepSec"
        description = "Detects Onyx Sleet SmallTiger/NukeSped DLL malware samples"
        date = "2026-11-16"
        reference = "https://www.microsoft.com/en-us/security/blog/2024/07/25/onyx-sleet-uses-array-of-malware-"
        hash1 = "f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c"
        hash2 = "0837dd54268c373069fc5c1628c6e3d75eb99c3b3efc94c45b73e2cf9a6f3207"
    strings:
        $hash_frag1 = { f3 2f 6b 22 99 13 d6 8d aa d9 37 cc 72 a5 7a a4 }
        $hash_frag2 = { 08 37 dd 54 26 8c 37 30 69 fc 5c 16 28 c6 e3 d7 }
        $smalltiger = "smalltiger" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and (any of ($hash_frag*) or $smalltiger)
}

Suricata Rules

SID 2026001: Detects DNS lookup for Vapor Panda C2 domain nginxmysql.com

alert dns $HOME_NET any -> any any (msg:"ARTEX Vapor Panda C2 Domain - nginxmysql.com"; dns.query; content:"nginxmysql.com"; nocase; classtype:trojan-activity; sid:2026001; rev:1; metadata:created_at 2026_11_16, deployment Perimeter;)

SID 2026002: Detects DNS lookup for Vapor Panda C2 domain sqlserver-sqlite.com

alert dns $HOME_NET any -> any any (msg:"ARTEX Vapor Panda C2 Domain - sqlserver-sqlite.com"; dns.query; content:"sqlserver-sqlite.com"; nocase; classtype:trojan-activity; sid:2026002; rev:1; metadata:created_at 2026_11_16, deployment Perimeter;)

SID 2026003: Detects DNS lookup for Vapor Panda C2 domain ddduuuppp.com

alert dns $HOME_NET any -> any any (msg:"ARTEX Vapor Panda C2 Domain - ddduuuppp.com"; dns.query; content:"ddduuuppp.com"; nocase; classtype:trojan-activity; sid:2026003; rev:1; metadata:created_at 2026_11_16, deployment Perimeter;)

SID 2026004: Detects DNS lookup for ARTEX LLM API reseller domain xcai.pro

alert dns $HOME_NET any -> any any (msg:"ARTEX LLM API Reseller Domain - xcai.pro"; dns.query; content:"xcai.pro"; nocase; classtype:trojan-activity; sid:2026004; rev:1; metadata:created_at 2026_11_16, deployment Perimeter;)

SID 2026005: Detects outbound connection to ARTEX C2 server 38.244.50.120 on port 18899

alert tcp $HOME_NET any -> 38.244.50.120 18899 (msg:"ARTEX C2 Server Connection - 38.244.50.120:18899"; flow:established,to_server; classtype:trojan-activity; sid:2026005; rev:1; metadata:created_at 2026_11_16, deployment Perimeter;)

SID 2026006: Detects outbound connection to Storm-0940 password-spray infrastructure 144.172.64.0/24

alert ip $HOME_NET any -> 144.172.64.0/24 any (msg:"Storm-0940 Password Spray Infrastructure - 144.172.64.0/24"; classtype:trojan-activity; sid:2026006; rev:1; metadata:created_at 2026_11_16, deployment Perimeter;)

SID 2026007: Detects outbound connection to Vapor Panda C2 IP 45.153.126.223

alert ip $HOME_NET any -> 45.153.126.223 any (msg:"Vapor Panda C2 IP - 45.153.126.223"; classtype:trojan-activity; sid:2026007; rev:1; metadata:created_at 2026_11_16, deployment Perimeter;)

SID 2026008: Detects outbound connection to Vapor Panda C2 IP 89.46.234.50

alert ip $HOME_NET any -> 89.46.234.50 any (msg:"Vapor Panda C2 IP - 89.46.234.50"; classtype:trojan-activity; sid:2026008; rev:1; metadata:created_at 2026_11_16, deployment Perimeter;)

SID 2026009: Detects outbound connection to Storm-3358 ARTEX server 91.92.240.238

alert ip $HOME_NET any -> 91.92.240.238 any (msg:"Storm-3358 ARTEX Server - 91.92.240.238"; classtype:trojan-activity; sid:2026009; rev:1; metadata:created_at 2026_11_16, deployment Perimeter;)

SID 2026010: Detects HTTP traffic containing artex-probe pattern in URI, indicating ARTEX reconnaissance

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ARTEX Probe Pattern in HTTP URI"; flow:established,to_server; http.uri; content:"artex-probe"; nocase; classtype:trojan-activity; sid:2026010; rev:1; metadata:created_at 2026_11_16, deployment Perimeter;)

Data Source Requirements

Recommendations

• Deploy all P1 IOC sweep queries immediately across Splunk indexes (firewall-pan, corelight, sysmon, winevent) with a 90-day retrospective window starting 1 September 2026.
• Block or alert on the following high-fidelity C2 domains at the DNS resolver and web proxy: nginxmysql.com, sqlserver-sqlite.com, ddduuuppp.com, xcai.pro.
• Add all 30+ documented C2 and proxy IPs to firewall block lists or at minimum to alert-only rules for monitoring. Prioritize 38.244.50.120 (port 18899), the 144.172.64.0/24 range, and the Storm-3358 IPs (91.92.240.238, 85.11.168.45, 31.77.229.35, 85.11.167.52).
• Deploy Suricata rules (SID 2026001-2026010) on network IDS/IPS sensors at the perimeter and internal segment boundaries.
• Implement webhook.site monitoring: alert on any outbound HTTPS POST/PUT requests to webhook.site from server-class systems or from processes other than web browsers on developer workstations.
• Audit all internet-facing Java/Tomcat/JSP application servers and MySQL databases for unauthorized JSP file creation, especially files matching the cl1217.jsp, f1219a.jsp, z1219.jsp naming convention.
• Review and restrict outbound access to LLM API endpoints (api.anthropic.com, api.deepseek.com, open.bigmodel.cn, api.x.ai) to only authorized development systems. Implement an allowlist rather than a blocklist approach.
• Deploy secret scanning tools (GitGuardian, TruffleHog, GitHub secret scanning with push protection) to detect exposed API keys that could be leveraged by ARTEX for LLM access.
• Ensure Sysmon is configured to log DLL loads (EventID 7) and file creation (EventID 11) across all endpoints, with particular attention to servers and high-value workstations.
• Coordinate with Azure AD / Entra ID administrators to review sign-in logs for distributed authentication failures from the documented Storm-0940 IP ranges.

Sources

• Microsoft - Storm-0940 Uses ARTEX Agentic AI
• SOCRadar - ARTEX AI Pentest Tool What Security Teams Need to Know
• CyberSecurityNews - ARTEX AI Hacking Framework
• CyberSecurityNews - Hackers Use ARTEX AI Agents
• Upwind - ARTEX Reaches the Financial Sector Storm-3358 Agentic Attack
• InfraStack - Storm-3358 ARTEX Campaign Analysis
• Zscaler - Threat Actor Abuses Agentic AI Pentesting
• VastZero - Threat Analysis ARTEX AI Penetration Testing Framework
• Microsoft - Onyx Sleet Uses Array of Malware
• CrowdStrike - Unknown Threat Actor Uses ARTEX to Target South Korean Banks
• DecryptionDigest - Vapor Panda ARTEX AI Cyberattack 140 Targets