Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon

Forks of the open source Artex framework, along with 45 similar pen-testing tools, remain capable of executing credential attacks and cloud breaches at machine speed across multiple industries.

AI penetration-testing tool Artex has proven to be a boon for threat actors large and small, taking familiar attacker playbooks and deploying them at machine speeds — ushering in a potentially new era for defenders looking to get ahead of AI-enabled threats.

In July, independent developer Autumn-27 published Artex to GitHub, an open source, multiagent AI penetration testing framework written in Go. It is, by intention, a legitimate tool. However, as is so often the case with pen-test tools (such as, famously, Cobalt Strike), threat actors found a way to take advantage of it for malicious use. By late summer and early fall, a range of threat actors were using it as part of their toolkit.

Artex is capable of brute-forcing passwords, dumping databases, enumerating and abusing APIs, and more. This positions it for credential compromise and lateral movement in its own right, but the agentic element means Artex can operate at inhuman speeds. Microsoft saw an AI agent move from scanning GitHub for secrets to exfiltrating data from an Azure Key Vault in five minutes, for example.

Steve Winterfeld, advisory CISO for Akamai, tells Dark Reading that while legitimate tool misuse is a known quantity, AI reduces the effort and expertise required to execute complex attacks. “What is particularly noteworthy about the Artex campaigns is the acceleration in speed, coordination, and autonomy,” he says. “Activities that previously required deliberate integration can now be chained together and executed with limited hacking skills.”

At the end of October, Artex’s creator deleted the original GitHub repository due to rampant abuse, but many forks of the tool remain, so the threat remains. But even if all the forks went offline and Artex was no longer a going concern, the underlying threat of frameworks like it is far from over.

GitGuardian yesterday, for instance, detailed 45 different agentic attack frameworks (Artex “siblings” as the researchers called them) that are all capable of conducting attacks autonomously with the help of an AI model. Depending on the tool, these pen-testing frameworks are capable of end-to-end attacks against a network, Web application targeting, and/or autonomous coding. Some even include built-in command-and-control functionality. That’s not to say these tools are inherently bad — pen-testing tools have many legitimate use cases — but it does illustrate the wide range of options for today’s attacker.

Artex & Its Ilk Appeal to a Wide Range of Attackers

The best-known incident to date involved China’s Storm-0940, which adapted Artex source code into its own offensive infrastructure. Last month, around Oct. 10, the actor used the Artex framework to launch a massive password-spraying and credential-stuffing campaign against more than 300 specific user accounts at eight critical organizations, making more than 151,000 authentication requests in the process. On average, this represented 2,900 attempts per minute without triggering automated lockout or alert.

When this largely failed, Storm-0940 pivoted to target ConnectWise’s internal infrastructure. Attackers exfiltrated trusted OAuth application credentials belonging to ConnectWise’s Cloud Backup application, allowing them to compromise more than 2,250 downstream Microsoft 365 and Azure environments within three hours of initial targeting.

Abuse extends far beyond a single threat actor or objective. Microsoft last week published a blog post discussing how a financially motivated Cambodia-based threat cluster tracked as Storm-3358 started using Artex in its attacks against financial organizations primarily (but not exclusively) in Southeast Asia. Microsoft said it observed Storm-3358 using Artex in combination with conventional automated tools to scan systems connected to the public internet, exploit vulnerabilities, and install open source remote access Trojans (RATs).

Microsoft added that other threat actors have used Artex agents “to scan and exploit vulnerabilities in Web applications, use Web shells for persistence on compromised Web servers, compromise credentials from public sources and compromised systems, and use compromised cloud identities for persistence and data exfiltration.”

CrowdStrike on Oct. 29 connected Artex-powered espionage activity to a threat actor it tracks as Vapor Panda, India’s CERT (CERT-In) tracked a financially motivated threat actor hitting financial institutions, and as of Nov. 4, Censys observed more than 1,400 internet-exposed Artex console deployments. That said, because Internet exposure is not required for use, Censys estimated actual global use to be higher.

Artex: A Tale as Old as Time, Told Better

Recent Artex activity stands out because much of the story involves things security practitioners have seen time and time again. Pen-test tool abuse, nation-state tooling moving downstream to financially motivated attackers, password spraying, supply-chain attacks, AI — it’s a threat intelligence greatest hits album. But Guillaume Valadon, head of cybersecurity research at GitGuardian, tells Dark Reading what stands out to him most is the fast pace of attacks and the agent’s initiative to accomplish the user’s goals.

“At GitGuardian, we wanted to see how Artex handles secrets, so we ran it in a sealed lab,” he says. “Artex ships no secret scanner, yet in every run where it acted, it found eight of the nine secrets. This included an AWS key recovered from git history. The model improvises on its hunt to reach the Artex user’s goals.”

Matt Snyder, Aviatrix head of security operations and threat research, says he was most surprised at how, despite the sophisticated nature of Artex’s framework, the operational maturity of many threat actors deploying it appears to be low (given how many hosts remain Internet-exposed).

“AI is lowering the skill floor for offensive operations without improving operational discipline. The framework may be sophisticated, but the operational security surrounding many deployments is not,” Snyder says. “This creates a dangerous combination in which more people can launch capable attacks, while poor security leaves their infrastructure, tooling, and potentially victim information exposed to anyone on the Internet.”

Increasing sophistication for lower grade attackers means, as always, defenders should be ready. Microsoft’s Storm-3358 blog includes extensive indicators of compromise and recommends considering tools like defensive honeypots which trick attackers into thinking they netted a valuable target.

Check Point advised in a blog post last week for organizations to expect greater automated pressure against exposed infrastructure. “Internet-facing systems should be continuously tested and hardened, with particular attention paid to weak authentication, exposed APIs, credential leakage, remote code execution (RCE) vulnerabilities and cloud storage permissions,” the blog post read.

Censys principal security researcher Silas Cutler offered encouraging words. Because the underlying tradecraft is conventional, the fundamentals still hold, he said, “Enforce MFA, monitor your attack surface, and practice good credential hygiene.”