One open-source AI intrusion framework, five operators: ARTEX moves into state espionage

A single open-source AI intrusion framework is now in the hands of at least five separate operators, four of them state actors ^[1][2][3]. On 29 October CrowdStrike reported that VAPOR PANDA, a China-nexus espionage actor, used ARTEX to run more than 200 targets in parallel over 11 days ^[1]. The same day Microsoft said North Korea’s Onyx Sleet and Pearl Sleet had used ARTEX since late October ^[2]. Eight days earlier Microsoft tied it to Storm-0940 and the ConnectWise compromise ^[3]. Its first public outing, in late September, was a criminal raid on South Korean lenders ^[4][5]. Defenders should treat ARTEX as shared commodity tooling, not one actor’s signature.

What the data says

Microsoft describes ARTEX as an open-source penetration testing framework that can drive any AI model. It is a multi-agent system written in Go with a web front end, and its agents record discovered assets and weaknesses in a shared graph ^[3]. Its interface can switch between English, Korean, Mandarin, Spanish and Japanese ^[3]. Cyber Security News reports that it was published on GitHub on 26 July 2026 and is China-developed ^[6]. Tech Times reports that it began as a winning entry in a Baidu security challenge; no other source we read confirms that ^[5]. Origin does not establish state involvement, and Tech Times says so ^[5].

CrowdStrike’s VAPOR PANDA report is the most detailed account. The actor has targeted government, think tank, energy and extractive organisations since 2021 ^[1]. From 17 October a single ARTEX controller worked against more than 200 organisations in at least 14 countries ^[1]. CrowdStrike confirmed post-exploitation at nine and saw password spraying or credential scanning at least 12 more ^[1]. Named targets include foreign ministries in Latin America, a Middle East interior ministry, European government bodies, 19 US organisations and telecommunications providers in the US, Belgium and the Philippines ^[1]. CrowdStrike also found staged target files for foreign ministries in Central America and Asia, without naming the Asian states ^[1].

The agents ran mainly on DeepSeek, with a second commercial model CrowdStrike could not identify ^[1]. Recovered transcripts show a human operator issuing instructions in Chinese at decision points, timestamped in China Standard Time ^[1]. In one intrusion the planning agents consumed roughly 1.4 billion input tokens ^[1]. At one pharmaceutical company the operator told the agents to find Windows hosts without CrowdStrike’s sensor, so follow-on work could focus on unmonitored machines ^[1].

The intrusion routes are familiar. At one victim, an unsigned SAML assertion and an XML external entity flaw gave access to the cloud instance metadata service and a role able to run commands on thousands of instances ^[1]. At a Greek government body, the operator supplied a 2022 mail-server directory export whose keys had likely never been rotated; the agent forged an administrator token and read mailboxes ^[1]. Where access held, the actor deployed BLOODALCHEMY ^[1]. Elastic first documented that backdoor in October 2023 within the REF5961 intrusion set, which it found inside the foreign ministry of an unnamed ASEAN member state and assessed as China-nexus ^[7][8]. Elastic’s reports do not name VAPOR PANDA; the link is CrowdStrike’s ^[7][10].

CrowdStrike states that VAPOR PANDA’s campaign is separate from Storm-0940 ^[1]. Microsoft says Storm-0940 used ARTEX against hundreds of organisations from as early as September, sometimes reaching privileged cloud access in under three hours, though most attempts failed ^[3]. Microsoft also says it has seen ARTEX users across multiple geographic regions ^[3].

Microsoft’s North Korean report places Onyx Sleet and Pearl Sleet at its ‘accelerating’ stage of AI adoption and says both have used ARTEX since late October ^[2]. It gives no targets, victims or indicators for that use ^[2]. Microsoft says North Korean AI-enabled operations remain human-directed and not fully autonomous ^[2]. Korean and secondary coverage repeats the ARTEX finding without adding evidence ^[9][11].

The South Korean case shows how ARTEX was first used. ThreatBook says the attacker targeted peripheral systems, including a loan-brokerage enquiry service and an employee mobile support app, and enumerated customer records by substituting identifiers ^[4]. CrowdStrike, as reported by Cyber Security News, assessed with moderate confidence that a likely Chinese-speaking, financially motivated operator was responsible, and found exposed AI session logs and ARTEX configuration files on the operator’s servers ^[6]. The figures differ. Tech Times reports more than 65,000 records across seven institutions ^[5]. ThreatBook reports about 67,000 people, with preliminary and partly unduplicated counts ^[4]. Cyber Security News gives no total ^[6].

What it means

ARTEX is following the path of earlier offensive frameworks: published openly, picked up by criminals, then adopted by state operators within weeks ^[3][4][6]. A shared tool blurs attribution. ARTEX markers on a network say which framework ran, not who ran it. CrowdStrike linked VAPOR PANDA through controller infrastructure, not through ARTEX itself ^[1].

The framework adds scale, not new access. CrowdStrike frames ARTEX as expansion of an existing mission, letting a small team pursue more targets at once ^[1]. Every intrusion it describes used a known weakness: an old export with unrotated keys, unsigned SAML, reachable metadata, unprotected hosts ^[1]. One analysis of the report puts confirmed compromise at no more than about 4.5 per cent of the 200 targets ^[10]. That is a low yield, but the cost per attempt is close to zero.

For the Asia-Pacific region the exposure is concrete. ARTEX’s first public victims were Korean financial firms ^[4][5]. VAPOR PANDA targeted a Philippine telecommunications provider and staged Asian foreign-ministry targets ^[1]. Its backdoor’s documented history begins inside an ASEAN foreign ministry ^[8]. CrowdStrike assesses that China-nexus adversaries will highly likely keep adopting agentic frameworks over the next 12 months ^[1].

What to do

• Rotate signing keys, preauthentication keys and service credentials after any suspected exposure, including keys held in old backups and directory exports ^[1].
• Enforce SAML signature validation and hunt for SAML sign-ins with no matching identity-provider events or unusual token lifetimes ^[1][13].
• Require IMDSv2 on cloud instances and set account-level enforcement so new launches cannot fall back; existing instances must be changed individually ^[12].
• Restrict cloud roles’ command-execution rights to the minimum, and alert on administration commands issued across many instances at once ^[1].
• Hunt for the ARTEX markers CrowdStrike and ThreatBook publish: ‘artx’ or ‘artex’ in command lines and cloud role names, ‘art18-‘ command comments, a ProgramData ‘artx5v’ folder, and user agents beginning ‘artex-enrich’ or containing ‘spa-api-recon’ ^[1][4].
• Load CrowdStrike’s BLOODALCHEMY indicators, and watch for renamed signed binaries side-loading DLLs from unusual paths ^[1][7].
• Close EDR coverage gaps, including servers not exposed to the internet; the operator looked specifically for unmonitored hosts ^[1].
• Enforce server-side identity and object-ownership checks on broker, employee and partner-facing APIs, and group low-rate, rotating-source requests by business object ^[4].
• Treat ARTEX evidence as a framework signal, not attribution, and correlate infrastructure before naming an actor ^[1][3].

The cyber operations view

Agentic frameworks change the economics of state intrusion more than its methods. VAPOR PANDA kept its targeting, its backdoor and its human direction, and used ARTEX to run many engagements at once ^[1]. North Korea’s adoption within weeks of the first public reporting shows how quickly such tools spread between services ^[2][3]. Defenders face more attempts, not cleverer ones. The best response remains removing the old keys, weak federation and unmonitored hosts that the agents found ^[1].