ARTEX: Attackers apply agentic AI

Sophos X-Ops is tracking ARTEX, an open-source agentic AI penetration testing framework that multiple threat actors have used in intrusions since its public release in July 2026. One of the most prominent cases is the ConnectWise Cloud Backup compromise in mid-October, which Microsoft attributes to Storm-0940, a group it assesses as “China-state aligned.”

How ARTEX works

ARTEX is an open-source, multi-agent penetration testing framework written in Go. It supports multiple LLM providers and compatible endpoints; in reported campaigns, operators have connected it to models including DeepSeek, GLM, and Grok. Given an objective, ARTEX has the following capabilities:

• Use planning agents to map the target and decide the next step
• Worker agents can invoke offensive tooling and feed results back into the planning process. In malicious deployments, this could include activities such as scanning, exploitation, credential access and webshell deployment
• Planning agents can adjust the plan and launch subsequent rounds via worker agents
• It records the assets and vulnerabilities it discovers in a graph as the test progresses
• Can attempt multiple breach paths at the same time

In campaigns described by Microsoft and Google/Mandiant, operators have supplied ARTEX with authentication material or compromised application credentials and used it against cloud APIs and services, such as Microsoft Graph.

Sophos countermeasures

Sophos has existing endpoint, network, and cloud protections covering multiple behaviours and indicators associated with reported ARTEX activity.

The protections below target ARTEX and the campaigns reported so far. Our evaluation of coverage is ongoing, and we will update this table as it changes.

Troj/Bckdr-SDA detects a backdoored copy of the ARTEX Docker image. The original project has been taken offline by its developer, so researchers sourcing the framework from unofficial mirrors and clones should treat those copies as untrusted.

Sophos has identified activity at a small number of customers that is consistent with ARTEX or other AI-assisted offensive tooling

Common themes include webshell and SQL Server command execution, credential theft, and attempts to move between systems. We’ve also seen rapid command sequences, repeated attempts with small changes, and structured output markers, consistent with agent-driven activity.

Across these instances, existing Sophos Endpoint protections surfaced multiple signals at multiple stages of the attacks. In many cases, Active Adversary Protection (AAP) was enabled and added further protection to disrupt subsequent attack behaviors.

It’s worth noting that, in line with what we’ve discussed previously regarding AI-enabled attacks, the attack activities are broadly the same, but the scale, noise, and persistence all increase significantly. In our telemetry, we noted hundreds of protection events relating to these attacks.

The rules we observed included:

Initial access and server execution

• Access_1b
• Access_3b
• Exec_34a and Exec_34b

Credential theft and collection

• Creds_4c
• Creds_4l
• Creds_2a and Creds_2d
• Creds_3b
• Collection_2c

Lateral movement and tool transfer

• Lateral_5a
• Exec_37a
• Lateral_1b

Web shells and execution activity

• Persist_26c
• Exec_6a and Exec_17a
• Evade_13a

AAP protections

• Disrupt_2a
• Disrupt_7e
• Disrupt_7f
• Disrupt_7g
• Disrupt_7h

Threat hunting indicators

These indicators come from ARTEX activity described in reported campaigns. In its report, Microsoft claims that Storm-0940 was using ARTEX “as early as September 2026,” so we recommend hunting back to at least this date. Additional reporting indicates that an ARTEX-related incident occurred in September 2026, targeting South Korean financial organizations.

In cloud environments, look for:

• Service principal credentials added, or roles assigned, by an application
• Application sign-ins with a scripted user agent

On hosts, look for:

• Temporary tooling and output files named i<intentID>[variant]_<purpose>.<ext>, for example i12345_b2.ps1.
• Files or paths beginning with artx, particularly under C:\Windows\Temp.
• Commands containing structured execution-verification markers – such as MARKER123/ARTX123, particularly when combined with rapid command sequences and repeated command variants
• Bursts of commands, repeated variants of the same command, and output written to temporary files.

Recommended actions

Several reported ARTEX campaigns have leveraged existing or compromised access, including stolen application credentials, consented third-party apps, and valid accounts. Sophos recommends the following steps as best practice:

• Audit service principals and enterprise applications in Microsoft Entra ID. Remove third-party app consents you no longer use, and review every credential addition and role assignment made since September 2026.
• Apply Conditional Access policies to workload identities where licensing allows, restricting application sign-ins to expected locations.
• Alert on application sign-ins with scripted user agents, and on authentication failure rates that exceed normal baselines.
• Automate first response. When an attack reaches privileged access in a short amount of time, containment steps such as disabling a service principal or revoking its credentials should run from a playbook, with an analyst confirming afterwards.
• If your own red team uses agentic frameworks, register their infrastructure and tooling names with your SOC so that authorized activity stands out.