{"slug": "artex-unveiled-key-pillars-of-offensive-ai", "title": "ARTEX Unveiled: Key Pillars of Offensive AI", "summary": "The open-source ARTEX framework, a multi-agent LLM penetration-testing tool written in Go with a Next.js frontend and PostgreSQL backend and licensed under AGPL-3.0, compresses cloud intrusions from multi-day engagements to under three hours, from initial target selection to Global Admin role assignment, according to a Guardz technical analysis. Guardz reports that China-state-aligned threat groups such as Storm-0940 deploy ARTEX for supply chain abuse and cloud espionage against Microsoft 365 customer environments, while financially motivated Chinese-speaking cybercriminals use it for credential stuffing, web application probing and data exfiltration. The framework, traced to the upstream repository Autumn-27/ARTEX, bypasses MFA through multi-tenant app consent and supports English, Korean, Mandarin, Spanish and Japanese interfaces, with targeted industries including aerospace, defense, financial services, government, semiconductor and manufacturing.", "body_md": "Agentic **offensive AI** has fundamentally changed enterprise **attack surface management**. This technical breakdown covers the ARTEX framework, its **dual-graph memory architecture**, and active **nation-state supply chain campaigns**.\n\nThe ARTEX framework highlights severe OAuth supply chain vulnerabilities. Operating at machine speed, automated agents bypass MFA through multi-tenant app consent, making continuous monitoring of service principals and instant token revocation critical to modern defense.\n\nThe conversation around ARTEX landed directly in our internal Slack channel. My colleague [Ariel Davidpur](https://www.linkedin.com/in/ariel-davidpur/) (a brilliant researcher) brought it to our attention after reports confirmed that attackers were using open-source AI tools on servers targeting South Korean banks. \n\nWhat caught our attention wasn’t just the tool’s automated capabilities, but how easily an open-source framework could lower the barrier for complex, machine-speed intrusions.\n\nThis blog post is a technical deep dive into the ARTEX framework, dissecting how it pairs multi-model LLM orchestration with PostgreSQL dual-graph memory to automate attack paths, while detailing concrete detection and remediation playbooks for modern defenders.\n\nFor more threat profiles, intelligence reports, and technical analyses of emerging offensive AI tools, visit the [Guardz Blog](https://guardz.com/blog/).\n\n## **Operational Context**\n\nThe weaponization of agentic Artificial Intelligence (AI) represents a fundamental shift in cyber warfare and enterprise cloud risk. By integrating Large Language Models (LLMs) directly into autonomous, multi-agent operational loops, threat actors can now condense complex attack timelines from multi-day engagements into compressed machine-speed campaigns lasting under three hours.\n\nThe ARTEX framework exemplifies this strategic inflection point. Capable of carrying an intrusion autonomously from initial reconnaissance and vulnerability identification through privilege escalation and bulk data exfiltration with minimal human oversight, ARTEX enables adversaries to scale offensive security workflows exponentially across hundreds of cloud environments simultaneously.\n\nARTEX is an open-source, multi-agent LLM penetration testing framework written in Go with an embedded Next.js frontend and a PostgreSQL backend. Originating as a Chinese open-source security research project (upstream repository `Autumn-27/ARTEX`, licensed under AGPL-3.0), the framework features multilingual user-interface and report generation capabilities supporting English, Korean, Mandarin, Spanish, and Japanese. \n\nOperationally, ARTEX exhibits a dual threat paradigm: China-state-aligned threat groups (such as Storm-0940) actively deploy it for supply chain abuse and cloud espionage, while financially motivated Chinese-speaking cybercriminals use it for rapid credential stuffing, web application probing, and data exfiltration targeting financial services and enterprise environments.\n\n| **Metric / Attribute** | **Operational Value / Context** | \n| **Peak Password Spray Rate** | Multiple failed logons/minute | \n| **M365 Tenants Targeted by Storm-0940** | Microsoft 365 customer environments | \n| **Time to Cloud Privilege Escalation** | Less than 3 hours (from initial target selection to Global Admin role assignment) | \n| **Targeted Industries** | Aerospace, Defense, Automotive, Chemicals, Energy, Financial Services, Government, Legal, Manufacturing, Media, Military, Semiconductor, Technology, E-Commerce, Logistics, Insurance, Retail, Education | \n\nThe strategic risk posed by machine-speed, AI-driven operations centers on eliminating traditional human operational bottlenecks. Autonomous agents operate continuously 24 hours a day, 7 days a week, unimpeded by human physical constraints or operational handoffs, and can evaluate multiple parallel breach paths simultaneously.\n\nFor Security Operations Center (SOC) defenders, this machine-speed acceleration generates massive telemetry volumes in compressed windows, drastically shrinking traditional defender dwell time and leaving security teams with virtually zero window to manually detect, correlate, and remediate compromises before full cloud privilege escalation occurs.\n\nUnderstanding ARTEX’s high-level operational impact requires a deep dive into its internal multi-agent architecture and dual-graph memory structures.\n\n## **Architecture & Agent Mechanics**\n\nThe ARTEX framework is architected around a decoupled multi-agent loop and dual-graph memory model, enabling autonomous execution of complex penetration tests. Driven by the `norma` agent Software Development Kit (SDK), the system decomposes overarching operational objectives into discrete intents, executes native system tools, records intermediate findings, and dynamically adjusts its strategy based on real-time target feedback.\n\n#### **Core Software & Database Stack**\n\nARTEX runs as a single Go binary compiled with embedded Next.js static web assets using Go’s `go:embed` functionality (`-tags embedui`). The backend relies on PostgreSQL (via the `pgx` driver) for persistent graph storage, automatically executing schema migrations on startup. \n\nSystem communications and management occur via REST endpoints, JSON Web Tokens (JWT) for authentication, and Server-Sent Events (SSE) for real-time dashboard telemetry over HTTP on the default port `8787`. Background network operations route through an integrated traffic-recording proxy listening on the default port `8788`, which functions as a Man-in-the-Middle (MITM) proxy to record all Bash, HTTP, and tool interaction telemetry for auditability and trace extraction.\n\nTo prevent token buffer exhaustion and context window collapse during execution, the framework integrates the **norma** SDK version `v0.4.3`. \n\nThis update implements a process-level tool output truncation harness (**CaptureOnce**\n\nDatabase state is governed by specific schema objects within PostgreSQL:\n\n- `assets` : Stores physical technical entities across the asset graph.\n- `companies` : Defines the top-level organizational entity owning the asset tree.\n- `task_scope` : Enforces pre-defined operational boundaries and target boundaries.\n- `exploration_nodes` : Tracks the discrete nodes forming the cognitive execution graph.\n- `exploration_anchors` : Maintains direct relational links binding cognitive nodes to technical assets.\n- `activity` : Log table recording step-by-step worker activity and execution traces.\n\n#### **Multi-Agent Ecosystem & Roles**\n\nThe framework orchestrates four primary agent modules:\n\n**Goals Module:** Deconstructs broad input parameters (such as root domains or IP ranges) into structured goal objects and enforces pre-defined operational boundaries (`task_scope`).\n\n**Planner Agent:** Serves as the single intent producer in the system. Woken by a graph-change event, the Planner reads the current exploration graph state and emits targeted intents to a worker frontier queue. It manages a persistent, multi-round shared to-do list to enforce ordered execution.\n\n**Worker Agents (xN):** Task-driven execution units (defaulting to 3 concurrent workers per task) that claim single intents from the queue. Workers execute command-line tools (including Kali Linux binaries, Bash scripts, and custom HTTP calls), write resulting facts or assets back to the dual graph, and terminate their single-intent lifecycle.\n\n**Mainagent:** Functions as an interactive interface allowing human operators to inspect agent progress, inject manual hints (`hint`), or redirect execution logic without interrupting the underlying engine scheduling loop.\n\n#### Dual-Graph Memory Architecture Analysis\n\nTo manage operational state, ARTEX maintains two distinct memory structures within PostgreSQL, linked explicitly through database anchors:\n\n- **Asset Graph (Globally Shared):**  - Acts as the central source-of-truth asset store shared across all tasks.\n  - Stores discrete technical entities structured by node types: `root_domain` ,`subdomain` ,`ip` ,`service` ,`app` , and`endpoint` , mapped under an overarching`companies` parent.\n  - Relationships (e.g., `domain` $\\rightarrow$`subdomain` $\\rightarrow$`service` $\\rightarrow$`endpoint` ) and deduplication keys are computed programmatically by backend Go logic rather than left to LLM discretion.\n- **Exploration Graph (Per-Task):**  - Tracks the reasoning lineage, progress, and hypothesis testing of a specific task.\n  - Nodes represent `goal` ,`intent` ,`fact` ,`finding` , and`hint` instances within`exploration_nodes` .\n  - Nodes are linked by explicit directional edges (`spawns` ,`yields` ,`derived_from` ,`proves` ) to record complete execution chains.\n- **Exploration Anchors:**  - Concrete binding between the two graphs is maintained by the table `exploration_anchors(node_id, asset_id)` .\n  - Anchors map abstract exploration entities (such as an `intent` to scan or a discovered`fact` ) directly to specific technical entities (such as an`ip` or`endpoint` ) in the Asset Graph, allowing bidirectional querying between technical scope and cognitive progression.\n- Concrete binding between the two graphs is maintained by the table \n\n#### **Cross-Worker Trace Sharing Mechanics**\n\nBecause deep penetration testing often surfaces intermediate observations (such as detailed application error messages, internal header leaks, or response body parameters) that do not immediately qualify as formal facts, ARTEX implements process-level intelligence sharing across parallel execution streams. Workers record step-by-step activity logs into the `activity` table.\n\nWhen a Worker requires additional context, it invokes `search_all_worker_traces(q)` to perform keyword searches across all other workers’ execution logs within the same task (automatically filtering out its own step logs). \n\nOnce candidate steps are identified, the agent uses `list_worker_traces` and `get_worker_trace(intent_id, step_ids)` to retrieve exact, raw process logs. This mechanism lets parallel worker processes leverage intermediate findings from peer workers without duplicating command execution or scanning overhead.\n\nBuilt on its internal Go engine and PostgreSQL memory model, ARTEX extends its operations externally through a multi-model LLM abstraction layer and a proxy command structure.\n\nNo Slack account needed.\n\n### **Multi-LLM Infrastructure**\n\nARTEX abstracts its Large Language Model backend, letting operators switch seamlessly between domestic, open-source, and commercial frontier models. This multi-model orchestration layer maximizes decision-making performance while bypassing regional restrictions or model-specific access caps.\n\n#### **Model Integration & Proxy Routing**\n\nIn real-world campaigns, ARTEX deployments have been observed utilizing a diverse array of underlying models, including DeepSeek v4.1-flash, GLM-5.3, Grok 4.6, Claude Code (Claude Opus 4-8), and Zhipu AI models. Configuration parameters allow flexible environment overrides via `ARTEX_LLM_PROVIDER`, `ARTEX_LLM_MODEL`, `ARTEX_LLM_BASE_URL`, and `ARTEX_LLM_PROXY`. \n\nTo obscure direct API connections to model providers, operators route outbound API calls through infrastructure proxy endpoints such as `xcai.pro`.\n\nWhen routing requests through OpenAI-compatible proxy paths, a critical API parameter constraint exists regarding response token caps. OpenAI-family models (such as `gpt-4o`) enforce a maximum response token cap of 16,384 tokens (` max_tokens`). \n\nHowever, standard OpenAI-compatible API endpoints default to a client request cap of 32,768 tokens. If an operator leaves the default request parameter at 32,768 when invoking OpenAI models via compatible proxy endpoints, the provider API immediately rejects the call with an **HTTP 400 Client Error (** max_tokens is too large). \n\nOperators configuring ARTEX for OpenAI models must explicitly limit `max_tokens` to 16,384 or lower within the LLM settings configuration to prevent command loop failure.\n\n#### **Prompts & Output Language Enforcement**\n\nTo maintain high reasoning accuracy during execution, ARTEX employs a segregated prompt management policy:\n\n- **Internal Reasoning Prompts:** The core system prompts instructing agents on goal decomposition, tool parameter formulation, and attack logic remain in their original benchmarked language (Mandarin Chinese). This design preserves the model’s baseline reasoning capabilities.\n\n- **Output Language Enforcement:** User-facing deliverables including finding titles, fact summaries, execution reports, and chat responses are forced into the targeted language (English by default; switchable to Korean, Chinese, Spanish, or Japanese) via a code-fixed directive function (`langDirective` in`agent/prompt.go` ). This function appends explicit language-instruction strings directly to each agent role’s system prompt before dispatch.\n\n#### **Command & Execution Infrastructure**\n\nForensic analysis of real-world intrusions, notably conducted by CrowdStrike, identified operational ARTEX command infrastructure hosted on Hong Kong-based cloud servers. Investigators uncovered exposed web directories housing active ARTEX configuration files, session logs, and Claude Code session histories. These servers functioned as centralized command platforms, allowing threat actors to orchestrate multi-threaded campaigns, manage proxy connections, and process exfiltrated data files.\n\nThe ARTEX framework’s technical mechanics are directly reflected in its real-world execution across nation-state and cybercrime operations.\n\n### **Real-World Campaign Analysis: Supply Chain & Regional Intrusions**\n\nDuring late 2026, security researchers identified a surge in active ARTEX operations, revealing a bifurcated threat landscape split between nation-state espionage campaigns and regional financial cybercrime.\n\n#### **Storm-0940 ConnectWise Supply Chain Campaign**\n\nBeginning as early as September 2026, the China state threat group Storm-0940 integrated ARTEX into its offensive infrastructure, resulting in a widespread supply chain compromise involving ConnectWise Cloud Backup multi-tenant applications.\n\n**Initial Access & Reconnaissance**\n\nStorm-0940 targeted specific multi-tenant OAuth application registrations within the ConnectWise and SkyKick Cloud Backup ecosystem:\n\n- `506e08f9-6e9a-4da4-942b-a099a03644ae` (ConnectWise Cloud Backup)\n- `24205314-2b89-4e07-a2a4-579e898a5640` (ConnectWise – MS Teams Integration)\n- `0de14c77-b9b0-4137-9360-34878a929827` (ConnectWise – MS Graph Integration)\n\nThe recommended guidelines explicitly instruct security teams to **inventory all four application IDs** associated with the vendor registration ecosystem (including related SkyKick legacy registrations) to prevent incomplete remediation across tenant environments.\n\n##### **Password Spray Metrics**\n\nFrom October 10 through October 123, 2026, host infrastructure at `144.172.64.99` launched an automated, cross-tenant password spraying campaign targeting thousands of accounts across eight organizations to gain initial access to Exchange Online and M365 resources. \n\nTelemetry recorded over 250,000 failed logon events, with more than 180,000 concentrated in a single day on October 11. Authentication volumes peaked at 3,000 failures per minute, and account lockout responses accounted for nearly 98% of all recorded telemetry.\n\n##### **Downstream M365 Exploitation**\n\nAfter obtaining compromised OAuth application secrets from ConnectWise infrastructure, Storm-0940 used ARTEX agents to automate app-only sign-ins across thousands of downstream Microsoft 365 customer tenants. Because the applications already possessed pre-existing admin-consented trust relationships, ARTEX agents authenticated silently without triggering interactive Multi-Factor Authentication (MFA) prompts.\n\nOperating at machine speed, the agents issued automated Microsoft Graph API requests to execute:\n\n- Comprehensive directory and tenant resource enumeration.\n- Addition of rogue credentials to existing service principals (`Update application – Certificates and secrets management` ) to establish persistent backdoors.\n- Self-assignment of high-privilege roles, specifically assigning service principals to the Global Administrator role (`Add member to a role` ).\n- Bulk secret extraction from Azure Key Vaults using `SecretGet` calls across multiple vaults.\n\n#### **Financially Motivated Attacks on South Korean Financial Sector**\n\nIn late September and early October 2026, threat actors deployed ARTEX against multiple South Korean retail banks and financial institutions. The agents performed automated web application probing, credential stuffing, autonomous lateral movement, and data exfiltration.\n\nUnlike espionage-focused campaigns, these operators targeted sensitive financial data and customer Personally Identifiable Information (PII). Intelligence indicates the actors actively researched Korean data breach marketplaces and underground Telegram communication channels to market and monetize the stolen banking datasets.\n\n#### **Automated Probing of Japanese Enterprises**\n\nForensic investigations conducted jointly by GMO Cybersecurity by Ierae, CrowdStrike, and JPCERT/CC exposed a cluster of AI-enabled attack servers leveraging ARTEX against Japanese entities.\n\n- **Forensic Discoveries & Vertical Clustering**\n Researchers identified an initial ARTEX infrastructure targeting 20 Japanese companies, then discovered six additional AI-enabled attack servers. Crucially, intelligence analysis revealed that**some of the initial  targeted assets belonged to the same industry sector** , showing how ARTEX conducts domain-specific vertical reconnaissance. Eight targeted firms across insurance, finance, logistics, e-commerce, retail, and education publicly disclosed data breaches during September and October 2026.\n\n- **API & Mobile Reverse-Engineering**\n JPCERT/CC documented advanced AI-assisted API probing tactics. Automated agents downloaded Android APK files and executed reverse-engineering utilities (`Blutter` and`jadx` ) to analyze Flutter and Android application structures.\nThe agents extracted hardcoded RSA private keys and app-signing logic, constructed valid authenticated API requests, executed Server-Side Request Forgery (SSRF) scripts, probed for OS command injection and path traversal, and deployed web shells for network persistence.\n\nAnalyzing these operational footprints provides clear visibility into threat actor attribution and operational profiles.\n\n### **Threat Actor Attribution & Profiles**\n\nARTEX operates across both state-sponsored intelligence entities and cybercriminal threat groups, using distinct geographic and financial vectors.\n\n| **Threat Actor** | **Alignment / Motivation** | **Key Targets** | **Core Tooling & Methods** | **Observed Dwell Time** | \n| **Storm-0940** | China-state aligned / Espionage & Data Theft | Global Aerospace, Defense, Govt, Tech, Energy, Semiconductors | ARTEX, Password spraying, OAuth app credential abuse, Graph API exploitation, Key Vault secret extraction | < 3 hours (Target selection to privileged cloud escalation) | \n| **Financially Motivated Cybercriminals** | Unattributed / Cybercrime & Financial Gain | South Korean Financial Sector, Japanese Enterprises | ARTEX, Credential stuffing, APK reverse-engineering ( `jadx` /`Blutter` ), Web shells, Telegram monetization channels | Rapid intrusion & exfiltration (~3 days operational disruption) | \n\n#### **Storm-0940 Deep-Dive**\n\nStorm-0940 is a China state threat actor active since at least 2021 with no known industry aliases. Historically, the group relied on manual password spraying, internet-facing application exploitation, and post-compromise OAuth credential additions to maintain cloud persistence and exfiltrate sensitive emails via Microsoft Graph.\n\nBy integrating ARTEX into its operational suite in September 2026, Storm-0940 eliminated manual operational delay. Automated multi-agent orchestration reduced the timeline from initial target selection to full cloud privilege escalation to under three hours, allowing the group to target hundreds of organizations simultaneously during the ConnectWise supply chain compromise.\n\n#### **Financially Motivated Chinese-Speaking Cybercriminals**\n\nOperating concurrently, financially motivated Chinese-speaking cybercriminals utilized ARTEX deployments configured with Mandarin system prompts and session configurations (supported by Claude Code session histories).\n\nRather than seeking long-term strategic persistence for intelligence gathering, these operators directed ARTEX agents to perform high-density credential stuffing and aggressive web application API exploitation. Their primary operational objective focused on rapid data exfiltration, targeting customer records for immediate resale on dark web marketplaces and Telegram channels.\n\nThese operational behaviors map directly to standardized cyber threat intelligence frameworks.\n\n### Conclusion & Key Resources\n\nThe rise of the **ARTEX framework** marks a decisive operational shift in cyber warfare, moving adversaries from manual, multi-day intrusions to automated, machine-speed campaigns. \n\nBy pairing dual-graph memory architecture with multi-model LLM orchestration, nation-state threat actors like **Storm-0940** and financially motivated cybercriminals can execute complex supply chain abuse and cloud privilege escalation in under three hours. \n\nDefenders must adapt by shifting from manual triage to automated service principal monitoring, OAuth permission audits, and instant token revocation playbooks.\n\n**Microsoft Security Incident Report:** Read the technical breakdown in [Microsoft Security’s Analysis of Storm-0940 and ARTEX](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) detailing the ConnectWise supply chain compromise.\n\nGuardz articles with the latest news\n\nGuardz Threat Intelligence: Access research repositories, detection artifacts, and ongoing threat analysis via the [Guardz Security Research Labs](https://github.com/guardzcom/security-research-labs/tree/main/Threat-Intel) Threat-Intel Repository.\n\n**Guardz Cybersecurity Blog:** Explore additional threat research, product updates, and security insights on the [Guardz Blog](https://guardz.com/blog/).", "url": "https://wpnews.pro/news/artex-unveiled-key-pillars-of-offensive-ai", "canonical_source": "https://guardz.com/blog/artex-agentic-ai-framework/", "published_at": "2026-10-27 12:14:26+00:00", "updated_at": "2026-10-27 12:44:47.712900+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "ai-safety", "large-language-models"], "entities": ["ARTEX", "Guardz", "Storm-0940", "Autumn-27/ARTEX", "Ariel Davidpur", "Microsoft 365", "PostgreSQL", "Next.js"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/artex-unveiled-key-pillars-of-offensive-ai", "markdown": "https://wpnews.pro/news/artex-unveiled-key-pillars-of-offensive-ai.md", "text": "https://wpnews.pro/news/artex-unveiled-key-pillars-of-offensive-ai.txt", "jsonld": "https://wpnews.pro/news/artex-unveiled-key-pillars-of-offensive-ai.jsonld"}}