Google reports threat actors using ARTEX in network intrusions

Google describes ARTEX as an autonomous, multi-agent framework for penetration testing and offensive command and control.[2] It is written in Go and includes an embedded Next.js web console, according to Google.[2] Six specialized sub-agents translate high-level tactical goals into machine commands.[2] Google says observed capabilities include Active Directory reconnaissance, privilege escalation, cloud-infrastructure profiling and custom webshell deployment.[2] The framework is one of several open-source platforms that GTIG and Mandiant say threat actors have abused; the others named in their reporting are Hexstrike and CAIRN.[2]

Google says agents have carried out significant portions of the attack lifecycle, including lateral movement, database exploitation and preparation for data exfiltration.[2] The company says agents can explore multiple attack paths, troubleshoot errors and achieve objectives in seconds or minutes.[2] GBHackers reports that individual ARTEX execution bursts lasted about two to 25 seconds, and one investigation recorded 27 events in 23 seconds while the tool probed AWS permissions.[1] Operators sometimes supplied compromised credentials and directed ARTEX to continue an intrusion.[1] Another iterative run generated 240 log events, including failures possibly caused by competing sub-agents.[1]

GBHackers reports that the activity spans financially motivated extortion groups and suspected cyberespionage operators, and affected organizations included software, industrial automation, semiconductor and telecommunications organizations in the United States and Europe.[1] It reports that operators typically reached deep system access in about four hours, although one case took 15 minutes.[1] The Hacker News reports that CrowdStrike attributed a campaign to China-based Vapor Panda, also known as VexatiousTemper, and said the group began using ARTEX on October 17, 2026, against more than 200 organizations worldwide.[3] Cybersecurity Dive reports targets in 14 countries.[4]

The Hacker News reports post-exploitation activity at nine organizations, where attackers deployed the BLOODALCHEMY backdoor, and password-spraying and credential-scanning activity at at least 12 additional organizations.[3] It says operators used ARTEX with DeepSeek and an unidentified subscription-based commercial large language model.[3] CrowdStrike said planning agents consumed about 1.4 billion input tokens in one intrusion.[3] Google says the ARTEX-associated campaign UNC7228 overlaps with activity Microsoft tracks as Storm-0940.[2] The developer announced ARTEX’s closure and discontinued maintenance on October 8, but forks including ScopeWeaver and commercial ARTEX PRO continue to circulate.[1][2] GBHackers cautions that current evidence shows noisy automation across intrusion stages, not universally stealthy, fully autonomous compromise.[1]