Agentic offensive AI has fundamentally changed enterprise attack surface management. This technical breakdown covers the ARTEX framework, its dual-graph memory architecture, and active nation-state supply chain campaigns.
The ARTEX framework highlights severe OAuth supply chain vulnerabilities. Operating at machine speed, automated agents bypass MFA through multi-tenant app consent, making continuous monitoring of service principals and instant token revocation critical to modern defense.
The conversation around ARTEX landed directly in our internal Slack channel. My colleague Ariel Davidpur (a brilliant researcher) brought it to our attention after reports confirmed that attackers were using open-source AI tools on servers targeting South Korean banks.
What caught our attention wasn’t just the tool’s automated capabilities, but how easily an open-source framework could lower the barrier for complex, machine-speed intrusions.
This blog post is a technical deep dive into the ARTEX framework, dissecting how it pairs multi-model LLM orchestration with PostgreSQL dual-graph memory to automate attack paths, while detailing concrete detection and remediation playbooks for modern defenders.
For more threat profiles, intelligence reports, and technical analyses of emerging offensive AI tools, visit the Guardz Blog.
Operational Context #
The weaponization of agentic Artificial Intelligence (AI) represents a fundamental shift in cyber warfare and enterprise cloud risk. By integrating Large Language Models (LLMs) directly into autonomous, multi-agent operational loops, threat actors can now condense complex attack timelines from multi-day engagements into compressed machine-speed campaigns lasting under three hours.
The ARTEX framework exemplifies this strategic inflection point. Capable of carrying an intrusion autonomously from initial reconnaissance and vulnerability identification through privilege escalation and bulk data exfiltration with minimal human oversight, ARTEX enables adversaries to scale offensive security workflows exponentially across hundreds of cloud environments simultaneously.
ARTEX is an open-source, multi-agent LLM penetration testing framework written in Go with an embedded Next.js frontend and a PostgreSQL backend. Originating as a Chinese open-source security research project (upstream repository Autumn-27/ARTEX, licensed under AGPL-3.0), the framework features multilingual user-interface and report generation capabilities supporting English, Korean, Mandarin, Spanish, and Japanese.
Operationally, ARTEX exhibits a dual threat paradigm: China-state-aligned threat groups (such as Storm-0940) actively deploy it for supply chain abuse and cloud espionage, while financially motivated Chinese-speaking cybercriminals use it for rapid credential stuffing, web application probing, and data exfiltration targeting financial services and enterprise environments.
| Metric / Attribute | Operational Value / Context | | Peak Password Spray Rate | Multiple failed logons/minute | | M365 Tenants Targeted by Storm-0940 | Microsoft 365 customer environments | | Time to Cloud Privilege Escalation | Less than 3 hours (from initial target selection to Global Admin role assignment) | | Targeted Industries | Aerospace, Defense, Automotive, Chemicals, Energy, Financial Services, Government, Legal, Manufacturing, Media, Military, Semiconductor, Technology, E-Commerce, Logistics, Insurance, Retail, Education |
The strategic risk posed by machine-speed, AI-driven operations centers on eliminating traditional human operational bottlenecks. Autonomous agents operate continuously 24 hours a day, 7 days a week, unimpeded by human physical constraints or operational handoffs, and can evaluate multiple parallel breach paths simultaneously.
For Security Operations Center (SOC) defenders, this machine-speed acceleration generates massive telemetry volumes in compressed windows, drastically shrinking traditional defender dwell time and leaving security teams with virtually zero window to manually detect, correlate, and remediate compromises before full cloud privilege escalation occurs. Understanding ARTEX’s high-level operational impact requires a deep dive into its internal multi-agent architecture and dual-graph memory structures.
Architecture & Agent Mechanics #
The ARTEX framework is architected around a decoupled multi-agent loop and dual-graph memory model, enabling autonomous execution of complex penetration tests. Driven by the norma agent Software Development Kit (SDK), the system decomposes overarching operational objectives into discrete intents, executes native system tools, records intermediate findings, and dynamically adjusts its strategy based on real-time target feedback.
Core Software & Database Stack
ARTEX runs as a single Go binary compiled with embedded Next.js static web assets using Go’s go:embed functionality (-tags embedui). The backend relies on PostgreSQL (via the pgx driver) for persistent graph storage, automatically executing schema migrations on startup.
System communications and management occur via REST endpoints, JSON Web Tokens (JWT) for authentication, and Server-Sent Events (SSE) for real-time dashboard telemetry over HTTP on the default port 8787. Background network operations route through an integrated traffic-recording proxy listening on the default port 8788, which functions as a Man-in-the-Middle (MITM) proxy to record all Bash, HTTP, and tool interaction telemetry for auditability and trace extraction.
To prevent token buffer exhaustion and context window collapse during execution, the framework integrates the norma SDK version v0.4.3.
This update implements a process-level tool output truncation harness (CaptureOnce
Database state is governed by specific schema objects within PostgreSQL:
assets: Stores physical technical entities across the asset graph.companies: Defines the top-level organizational entity owning the asset tree.task_scope: Enforces pre-defined operational boundaries and target boundaries.exploration_nodes: Tracks the discrete nodes forming the cognitive execution graph.exploration_anchors: Maintains direct relational links binding cognitive nodes to technical assets.activity: Log table recording step-by-step worker activity and execution traces.
Multi-Agent Ecosystem & Roles
The framework orchestrates four primary agent modules:
Goals Module: Deconstructs broad input parameters (such as root domains or IP ranges) into structured goal objects and enforces pre-defined operational boundaries (task_scope).
Planner Agent: Serves as the single intent producer in the system. Woken by a graph-change event, the Planner reads the current exploration graph state and emits targeted intents to a worker frontier queue. It manages a persistent, multi-round shared to-do list to enforce ordered execution.
Worker Agents (xN): Task-driven execution units (defaulting to 3 concurrent workers per task) that claim single intents from the queue. Workers execute command-line tools (including Kali Linux binaries, Bash scripts, and custom HTTP calls), write resulting facts or assets back to the dual graph, and terminate their single-intent lifecycle.
Mainagent: Functions as an interactive interface allowing human operators to inspect agent progress, inject manual hints (hint), or redirect execution logic without interrupting the underlying engine scheduling loop.
Dual-Graph Memory Architecture Analysis
To manage operational state, ARTEX maintains two distinct memory structures within PostgreSQL, linked explicitly through database anchors:
- Asset Graph (Globally Shared): - Acts as the central source-of-truth asset store shared across all tasks.
- Stores discrete technical entities structured by node types:
root_domain,subdomain,ip,service,app, andendpoint, mapped under an overarchingcompaniesparent. - Relationships (e.g.,
domain$\rightarrow$subdomain$\rightarrow$service$\rightarrow$endpoint) and deduplication keys are computed programmatically by backend Go logic rather than left to LLM discretion.
- Stores discrete technical entities structured by node types:
- Exploration Graph (Per-Task): - Tracks the reasoning lineage, progress, and hypothesis testing of a specific task.
- Nodes represent
goal,intent,fact,finding, andhintinstances withinexploration_nodes. - Nodes are linked by explicit directional edges (
spawns,yields,derived_from,proves) to record complete execution chains.
- Nodes represent
- Exploration Anchors: - Concrete binding between the two graphs is maintained by the table
exploration_anchors(node_id, asset_id).- Anchors map abstract exploration entities (such as an
intentto scan or a discoveredfact) directly to specific technical entities (such as aniporendpoint) in the Asset Graph, allowing bidirectional querying between technical scope and cognitive progression.
- Anchors map abstract exploration entities (such as an
- Concrete binding between the two graphs is maintained by the table
Cross-Worker Trace Sharing Mechanics
Because deep penetration testing often surfaces intermediate observations (such as detailed application error messages, internal header leaks, or response body parameters) that do not immediately qualify as formal facts, ARTEX implements process-level intelligence sharing across parallel execution streams. Workers record step-by-step activity logs into the activity table.
When a Worker requires additional context, it invokes search_all_worker_traces(q) to perform keyword searches across all other workers’ execution logs within the same task (automatically filtering out its own step logs).
Once candidate steps are identified, the agent uses list_worker_traces and get_worker_trace(intent_id, step_ids) to retrieve exact, raw process logs. This mechanism lets parallel worker processes leverage intermediate findings from peer workers without duplicating command execution or scanning overhead.
Built on its internal Go engine and PostgreSQL memory model, ARTEX extends its operations externally through a multi-model LLM abstraction layer and a proxy command structure.
No Slack account needed.
Multi-LLM Infrastructure
ARTEX abstracts its Large Language Model backend, letting operators switch seamlessly between domestic, open-source, and commercial frontier models. This multi-model orchestration layer maximizes decision-making performance while bypassing regional restrictions or model-specific access caps.
Model Integration & Proxy Routing
In real-world campaigns, ARTEX deployments have been observed utilizing a diverse array of underlying models, including DeepSeek v4.1-flash, GLM-5.3, Grok 4.6, Claude Code (Claude Opus 4-8), and Zhipu AI models. Configuration parameters allow flexible environment overrides via ARTEX_LLM_PROVIDER, ARTEX_LLM_MODEL, ARTEX_LLM_BASE_URL, and ARTEX_LLM_PROXY.
To obscure direct API connections to model providers, operators route outbound API calls through infrastructure proxy endpoints such as xcai.pro.
When routing requests through OpenAI-compatible proxy paths, a critical API parameter constraint exists regarding response token caps. OpenAI-family models (such as gpt-4o) enforce a maximum response token cap of 16,384 tokens ( max_tokens).
However, standard OpenAI-compatible API endpoints default to a client request cap of 32,768 tokens. If an operator leaves the default request parameter at 32,768 when invoking OpenAI models via compatible proxy endpoints, the provider API immediately rejects the call with an HTTP 400 Client Error ( max_tokens is too large).
Operators configuring ARTEX for OpenAI models must explicitly limit max_tokens to 16,384 or lower within the LLM settings configuration to prevent command loop failure.
Prompts & Output Language Enforcement
To maintain high reasoning accuracy during execution, ARTEX employs a segregated prompt management policy:
-
Internal Reasoning Prompts: The core system prompts instructing agents on goal decomposition, tool parameter formulation, and attack logic remain in their original benchmarked language (Mandarin Chinese). This design preserves the model’s baseline reasoning capabilities.
-
Output Language Enforcement: User-facing deliverables including finding titles, fact summaries, execution reports, and chat responses are forced into the targeted language (English by default; switchable to Korean, Chinese, Spanish, or Japanese) via a code-fixed directive function (
langDirectiveinagent/prompt.go). This function appends explicit language-instruction strings directly to each agent role’s system prompt before dispatch.
Command & Execution Infrastructure
Forensic analysis of real-world intrusions, notably conducted by CrowdStrike, identified operational ARTEX command infrastructure hosted on Hong Kong-based cloud servers. Investigators uncovered exposed web directories housing active ARTEX configuration files, session logs, and Claude Code session histories. These servers functioned as centralized command platforms, allowing threat actors to orchestrate multi-threaded campaigns, manage proxy connections, and process exfiltrated data files.
The ARTEX framework’s technical mechanics are directly reflected in its real-world execution across nation-state and cybercrime operations.
Real-World Campaign Analysis: Supply Chain & Regional Intrusions
During late 2026, security researchers identified a surge in active ARTEX operations, revealing a bifurcated threat landscape split between nation-state espionage campaigns and regional financial cybercrime.
Storm-0940 ConnectWise Supply Chain Campaign
Beginning as early as September 2026, the China state threat group Storm-0940 integrated ARTEX into its offensive infrastructure, resulting in a widespread supply chain compromise involving ConnectWise Cloud Backup multi-tenant applications.
Initial Access & Reconnaissance
Storm-0940 targeted specific multi-tenant OAuth application registrations within the ConnectWise and SkyKick Cloud Backup ecosystem:
- `506e08f9-6e9a-4da4-942b-a099a03644ae` (ConnectWise Cloud Backup)
- `24205314-2b89-4e07-a2a4-579e898a5640` (ConnectWise – MS Teams Integration)
- `0de14c77-b9b0-4137-9360-34878a929827` (ConnectWise – MS Graph Integration)
The recommended guidelines explicitly instruct security teams to inventory all four application IDs associated with the vendor registration ecosystem (including related SkyKick legacy registrations) to prevent incomplete remediation across tenant environments.
Password Spray Metrics
From October 10 through October 123, 2026, host infrastructure at 144.172.64.99 launched an automated, cross-tenant password spraying campaign targeting thousands of accounts across eight organizations to gain initial access to Exchange Online and M365 resources.
Telemetry recorded over 250,000 failed logon events, with more than 180,000 concentrated in a single day on October 11. Authentication volumes peaked at 3,000 failures per minute, and account lockout responses accounted for nearly 98% of all recorded telemetry.
Downstream M365 Exploitation
After obtaining compromised OAuth application secrets from ConnectWise infrastructure, Storm-0940 used ARTEX agents to automate app-only sign-ins across thousands of downstream Microsoft 365 customer tenants. Because the applications already possessed pre-existing admin-consented trust relationships, ARTEX agents authenticated silently without triggering interactive Multi-Factor Authentication (MFA) prompts.
Operating at machine speed, the agents issued automated Microsoft Graph API requests to execute:
- Comprehensive directory and tenant resource enumeration.
- Addition of rogue credentials to existing service principals (
Update application – Certificates and secrets management) to establish persistent backdoors. - Self-assignment of high-privilege roles, specifically assigning service principals to the Global Administrator role (
Add member to a role). - Bulk secret extraction from Azure Key Vaults using
SecretGetcalls across multiple vaults.
Financially Motivated Attacks on South Korean Financial Sector
In late September and early October 2026, threat actors deployed ARTEX against multiple South Korean retail banks and financial institutions. The agents performed automated web application probing, credential stuffing, autonomous lateral movement, and data exfiltration.
Unlike espionage-focused campaigns, these operators targeted sensitive financial data and customer Personally Identifiable Information (PII). Intelligence indicates the actors actively researched Korean data breach marketplaces and underground Telegram communication channels to market and monetize the stolen banking datasets.
Automated Probing of Japanese Enterprises
Forensic investigations conducted jointly by GMO Cybersecurity by Ierae, CrowdStrike, and JPCERT/CC exposed a cluster of AI-enabled attack servers leveraging ARTEX against Japanese entities.
-
Forensic Discoveries & Vertical Clustering Researchers identified an initial ARTEX infrastructure targeting 20 Japanese companies, then discovered six additional AI-enabled attack servers. Crucially, intelligence analysis revealed thatsome of the initial targeted assets belonged to the same industry sector , showing how ARTEX conducts domain-specific vertical reconnaissance. Eight targeted firms across insurance, finance, logistics, e-commerce, retail, and education publicly disclosed data breaches during September and October 2026.
-
API & Mobile Reverse-Engineering JPCERT/CC documented advanced AI-assisted API probing tactics. Automated agents downloaded Android APK files and executed reverse-engineering utilities (
Blutterandjadx) to analyze Flutter and Android application structures. The agents extracted hardcoded RSA private keys and app-signing logic, constructed valid authenticated API requests, executed Server-Side Request Forgery (SSRF) scripts, probed for OS command injection and path traversal, and deployed web shells for network persistence.
Analyzing these operational footprints provides clear visibility into threat actor attribution and operational profiles.
Threat Actor Attribution & Profiles
ARTEX operates across both state-sponsored intelligence entities and cybercriminal threat groups, using distinct geographic and financial vectors.
| Threat Actor | Alignment / Motivation | Key Targets | Core Tooling & Methods | Observed Dwell Time |
| Storm-0940 | China-state aligned / Espionage & Data Theft | Global Aerospace, Defense, Govt, Tech, Energy, Semiconductors | ARTEX, Password spraying, OAuth app credential abuse, Graph API exploitation, Key Vault secret extraction | < 3 hours (Target selection to privileged cloud escalation) |
| Financially Motivated Cybercriminals | Unattributed / Cybercrime & Financial Gain | South Korean Financial Sector, Japanese Enterprises | ARTEX, Credential stuffing, APK reverse-engineering ( jadx /Blutter ), Web shells, Telegram monetization channels | Rapid intrusion & exfiltration (~3 days operational disruption) |
Storm-0940 Deep-Dive
Storm-0940 is a China state threat actor active since at least 2021 with no known industry aliases. Historically, the group relied on manual password spraying, internet-facing application exploitation, and post-compromise OAuth credential additions to maintain cloud persistence and exfiltrate sensitive emails via Microsoft Graph.
By integrating ARTEX into its operational suite in September 2026, Storm-0940 eliminated manual operational delay. Automated multi-agent orchestration reduced the timeline from initial target selection to full cloud privilege escalation to under three hours, allowing the group to target hundreds of organizations simultaneously during the ConnectWise supply chain compromise.
Financially Motivated Chinese-Speaking Cybercriminals
Operating concurrently, financially motivated Chinese-speaking cybercriminals utilized ARTEX deployments configured with Mandarin system prompts and session configurations (supported by Claude Code session histories).
Rather than seeking long-term strategic persistence for intelligence gathering, these operators directed ARTEX agents to perform high-density credential stuffing and aggressive web application API exploitation. Their primary operational objective focused on rapid data exfiltration, targeting customer records for immediate resale on dark web marketplaces and Telegram channels.
These operational behaviors map directly to standardized cyber threat intelligence frameworks.
Conclusion & Key Resources
The rise of the ARTEX framework marks a decisive operational shift in cyber warfare, moving adversaries from manual, multi-day intrusions to automated, machine-speed campaigns.
By pairing dual-graph memory architecture with multi-model LLM orchestration, nation-state threat actors like Storm-0940 and financially motivated cybercriminals can execute complex supply chain abuse and cloud privilege escalation in under three hours.
Defenders must adapt by shifting from manual triage to automated service principal monitoring, OAuth permission audits, and instant token revocation playbooks.
Microsoft Security Incident Report: Read the technical breakdown in Microsoft Security’s Analysis of Storm-0940 and ARTEX detailing the ConnectWise supply chain compromise.
Guardz articles with the latest news
Guardz Threat Intelligence: Access research repositories, detection artifacts, and ongoing threat analysis via the Guardz Security Research Labs Threat-Intel Repository.
Guardz Cybersecurity Blog: Explore additional threat research, product updates, and security insights on the Guardz Blog.