TLDR
- ARTEX is an open-source, LLM-driven pentest framework. A Go binary with an embedded Next.js UI, PostgreSQL state, a mitmproxy recording shim, a planner agent, and (by default) 3 worker agents per task.
- It lowers the cost and time of existing attacks rather than inventing new ones.
- Since late August 2026, multiple clusters have used it. CrowdStrike says VAPOR PANDA directed one controller at 200+ organisations in 11 days, with nine confirmed compromises.
- Another vendor says Storm-0940 attempted sign-ins to 2,250+ tenants. Other research groups report more clusters.
- ARTEX is noisy, but much of what it does uses valid credentials and supported features, so rules tuned only for quiet C2 implants will miss it.
For the last two weeks, ARTEX has been on every CISO’s radar, and every blue team has had multiple meetings about it. Honestly, most of what has been said deserves to be ignored. The threats are serious enough to take seriously, but giving ARTEX credit for rewriting offensive security overnight is absurd.
What ARTEX did is cheaper and more boring than that, and the boring version is what you should actually be worried about.
ARTEX is a logistics upgrade on techniques that have worked for twenty years. If your app would fall to a motivated script kiddie with Burp Suite over a weekend, ARTEX lets the script kiddie do it against hundreds, if not thousands, of targets at once. The question worth debating is whether the lowered floor-of-effort puts your attack surface inside the new reachable set.
What ARTEX actually is
A user going by Autumn-27 published ARTEX on GitHub on July 26, 2026, under AGPL-3.0. The same developer also wrote ScopeSentry, a Chinese asset-discovery platform that ARTEX uses as its recon foundation.
Stack: one Go binary with an embedded Next.js frontend, PostgreSQL for state, and mitmproxy recording every worker HTTP request.
Agents: a planner reads a goal and dispatches “intents” to N workers (default 3 per task). Workers claim intents and run real tools such as Bash, Nmap, curl, ripgrep, and HTTP clients. Each task keeps an asset graph and an exploration graph.
Models: provider-agnostic. Anthropic, OpenAI, or any OpenAI-compatible endpoint can be set in the UI.
On October 8, one day after CrowdStrike’s report on South Korean bank intrusions, Autumn-27 denied involvement and made the project closed-source. The repository was taken down. Archived copies, translations, and forks persist, including ScopeWeaver, “ARTEX PRO,” and a Korean edition.
CrowdStrike’s South Korea report identified DeepSeek v4.1-flash as the main model, likely bought through a reseller. Many researchers also saw DeepSeek and Kimi models, and one operator reportedly switched to them after Claude refused the tasks.
VAPOR PANDA ran mainly on DeepSeek plus a second commercial model CrowdStrike could not identify. Another vendor’s workspace analysis also saw Claude Code, OpenAI Codex, and Grok workspaces used alongside ARTEX, so Western tools are not absent from these operations.
Is it really worth worrying about
Yes, if you have a large attack surface without a continuous pentesting program in your security strategy. ARTEX changes who can exploit your app and at what cost. It lowers the floor for exploiting low-hanging vulnerabilities that would otherwise be caught by DAST or SAST.
The damage is economic, not technical. A low-skill operator gets reach and parallelism they could not previously afford. A skilled operator paired with ARTEX becomes a genuinely dangerous weapon, which is what the VAPOR PANDA transcripts actually show.
So let’s talk numbers.
- ~3 months from GitHub release to attacker staple. Mandiant observed abuse from late August (trade press).
- 1,465 exposed ARTEX consoles on the public internet as of November 4, 2026. Around 650 share standardised configurations across two hosting networks, leaving ~815 distinct-looking deployments. Some belong to authorised testers, so the true adversary footprint is likely higher (internet-scanning data).
- 2,557 systems have ever hosted ARTEX panels. 1,608 remain live and public (separate vendor scanning).
- Storm-0940 campaign: sign-in attempts to 2,250+ tenants, peaking at 2,900 per minute (vendor reporting).
- ~1.4 billion input tokens consumed by planning agents in a single VAPOR PANDA intrusion. CrowdStrike notes total campaign use was far higher and gives no dollar figure.
- $145 to $1,500 estimated model cost per criminal campaign. One two-week operation used ~36 billion tokens for $700 to $1,500 (researcher estimate).
Mandiant also cites UNC7228 (overlapping Storm-0940), financially motivated extortion groups, and other suspected PRC-nexus clusters. Other researchers describe criminal operators. Activity dates back to August or September, so this is not a single 30-day spike.
Who should worry, practically?
If you tick two or more of these, ARTEX-class tooling has a cost-effective path to you.
✓ Long-lived secrets (cloud keys, service principal secrets, OAuth app credentials) sitting in public repos, configs, or old exports. This is the most-reported entry point.
✓ Internet-facing apps or APIs with weak or path-based auth, SAML or XML parsing flaws, or unpatched appliances.
✓ Large sprawl: many subdomains and microservices with OpenAPI specs that drift behind the real routes.
✓ Exposed administrative interfaces (cloud consoles, publishing endpoints, orchestration services).
✓ Third-party apps with broad tenant access, as in the ConnectWise case.
✓ Financial services, crypto, or payments. Already targeted in South Korea and Japan, and one operator-prompt analysis also named financial and crypto firms.
✓ Operations in Japan, South Korea, India, Southeast Asia, or in government, defence, semiconductor, pharma, or telecom. One vendor’s prompt analysis named organisations in about 20 jurisdictions, including India, Malaysia, Indonesia, and Thailand. CrowdStrike’s targets spanned Latin America, Europe, the Middle East, and the U.S.
✓ Legacy framework versions anywhere in the stack.
Is this our Cobalt Strike moment
Partly. Trade press and Mandiant both draw the comparison. Attackers have long repurposed red-team tools, and ARTEX is following the same path much faster. How much faster depends on where you start the clock. Cobalt Strike launched in 2012, abuse grew from about 2015, and cracked copies spread widely after 2020.
The real difference between the two tools is stealth. Cobalt Strike can be stealthy, and operating it well needs real skill. ARTEX inverts that. Threat actor skill matters less. Model access and compute matter more. The published campaigns show operators repeating well-known techniques (subdomain enumeration, auth bypass fuzzing, credential spray, directory brute force, parameter tampering) faster and against more targets than a human could cover.
In skilled hands, though, it is a dangerous weapon. VAPOR PANDA is an established espionage group that paired ARTEX with its own backdoor and tradecraft, and the criminal operators researchers caught mostly set goals and watched progress.
ARTEX is loud by default. Mandiant documented bursts like 27 events in 23 seconds probing cloud permissions, 500+ web requests fuzzing file names against a server, and incrementing marker strings in filenames, account names, and paths. Easy signals if your rules look for them. The catch is that much of ARTEX’s activity uses valid credentials and supported APIs, which static indicators miss. The agents also rotate fingerprints, so IP-based blocking helps little.
So no, this is not a Cobalt Strike moment in the skill sense. It is a cost-per-attempt moment, which is a bigger problem because the economics apply to every attacker, not just the ones who learn the tool.
Where Astra fits
Two or three months ago, we raised a billboard in the Silicon Valley of India that said: “Hack autonomously before attackers do.” It was a technical bet on where the offensive side of the market was headed. ARTEX showed up eight weeks later. The posture is clear: run autonomous pentesting against your own environment before someone else runs it for you.
Both tools exist for the same reason. The attacker clock has decoupled from the defender clock, and continuous autonomous pentesting is the only coverage model that keeps up.
Mechanically, they are close. Both decompose a goal into tasks, run agents in parallel, and consolidate findings into a graph. The difference is what wraps around that core. ARTEX is a FOSS framework. Astra is a closed-source autonomous pentesting platform. One is a toolkit. The other is a service that owns the outcome.
Astra ships with human-validated findings, near-zero false positives, enterprise support, and reliably catches business-logic flaws such as IDOR and BOLA. Every engagement runs under OWASP APTS governance (scope enforcement, production database safeguards, rate limiting, human oversight), so our agents do not delete tables, drop collections, or trash state on the way to a proof of concept. That is the exact failure mode APTS was published to prevent.
If you have engineering hours to burn and in-house offensive skill, go run ARTEX. Treat it like an attacker would. Point it at your own perimeter, read the transcripts, and feed what you learn back into your detections. It is a legitimate exercise for teams already building offensive capability.
If you want the same outcome without the overhead, that is what Astra is for.
Book a demo either way. Do not compromise on security while you decide.
Final thoughts
ARTEX may not be as chaotic as Cobalt Strike, but it can cause the same kind of damage if teams are not concentrating on basic security. With this framework and a few dollars of compute, a script kiddie can put you through months of paperwork, legal review, and public embarrassment.
The posture that makes sense right now is a continuous or autonomous pentesting program sitting alongside your scanner stack, clearing your remediation queue on a cadence that matches your deploys instead of your fiscal year.
If remediation is the bottleneck, our autonomous pentesting platform closes that loop at the fix end too. Confirmed findings flow into your dev environment through our MCP integration, so a developer in Cursor or Claude Code can accept the fix in one click, run the tests, and ship the patch inside the same session the finding was reported.
ARTEX is not the end of this story. It is the first framework in its category to reach real campaigns. The next one will be stealthier. Plan for that now.
