Threat Intelligence

ARTEX: The AI Pentest Tool Now Powering Autonomous Cyberattacks

SOCRadar · 5 Nov 2026

Key Takeaway Assume attackers can now move faster and at greater scale with AI, so tighten basics such as multi-factor authentication, prompt patching and monitoring of Microsoft 365 sign-ins.

ARTEX started as a research project on GitHub and is now behind some of the fastest-moving AI-driven attacks of 2026. It is a framework written in Go and published in July 2026 by a Chinese developer using the handle Autumn-27. It was pitched for learning, research and testing authorised assets. A team of AI agents carries out reconnaissance, exploitation, privilege escalation and data theft with little human input.

Its first confirmed malicious use was against South Korean banks. Within weeks it appeared in a Microsoft 365 supply chain operation attributed to the China-state-aligned Storm-0940, and in a global espionage push by Vapor Panda that touched more than 200 organisations. SOCRadar notes that no vendor has linked the four operator clusters beyond their shared use of the tool.

The concern is scale. Traditional automation replays fixed scripts, while ARTEX agents read each result and decide the next step, so one controller can run parallel intrusions against hundreds of targets. As models get cheaper, attack volume depends more on computing power than on staff numbers. AhnLab reported ARTEX instances on about 600 IP addresses on 6 October 2026, and a researcher has since mapped more than 3,600. About 89% of those had never been seen scanning the internet, and fewer than 3% were flagged as malicious or suspicious, so most ARTEX servers stay quiet. Another open-source agent platform, Cairn, was tied to an actor that targeted more than 100 company websites.

ARTEX agentic AI AI security Storm-0940 threat intelligence

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.